3.2 Antivirus & FortiSandbox Integration

3.2 Antivirus & FortiSandbox Integration

Fortinet’s content security architecture combines traditional pattern-based Antivirus (AV) scanning with dynamic FortiSandbox zero-day threat analysis. This layered defense enables FortiGate to block known malicious files at wire speed while isolating and analyzing sophisticated, previously unknown threats.

---

FortiGuard Antivirus Engine & Databases

The FortiGate Antivirus engine scans network protocols—including HTTP, HTTPS, FTP, FTPS, SMTP, SMTPS, POP3, POP3S, IMAP, IMAPS, and MAPI—for known malware signatures delivered by FortiGuard.

1. Signature Database Options

Fortinet offers different signature database tiers tailored to device hardware capabilities and security compliance requirements:

• Normal Database: Default database included on all FortiGate models. Contains active, prevalent malware signatures identified in the wild. Optimized for low RAM consumption and fast lookup speed.
• Extended Database: Available on FortiGate models with higher RAM capacities. Includes low-prevalence, historical, and dormant malware signatures alongside the Normal database for comprehensive protection.
• Extreme Database: Designed for ultra-high security enterprise and government environments with abundant memory, containing rare threats and specialized industrial control system (ICS/SCADA) signatures.
• Mobile Malware Database: Specialized signature set identifying Android, iOS, and mobile operating system malicious binaries.

2. FortiGuard Virus Outbreak Prevention (VOP)

Traditional signature updates take time to package and distribute. FortiGuard Virus Outbreak Prevention (VOP) closes the vulnerability window between outbreak detection and signature release:

• Uses real-time cloud lookups against FortiGuard Global Threat Intelligence.
• Evaluates file hashes, source IPs, and suspicious URLs associated with active malware campaigns.
• Enables FortiGate to block zero-hour file outbreaks minutes before a formal AV signature update is downloaded locally.

---

Antivirus Profile Configuration

Antivirus profiles define scanning parameters per protocol and specify detection actions. In FortiOS 7.6, AV profiles operate in either Flow-based or Proxy-based inspection mode depending on the policy configuration.

Key Profile Settings

• Inspected Protocols: Enable or disable scanning independently for HTTP, SMTP, POP3, IMAP, FTP, and CIFS/SMB.
• Archive Scanning: Configure extraction depth for compressed archives (zip, rar, 7z, tar, gz). Administrators can set limits for maximum archive depth, uncompressed file size, and block invalid or encrypted compressed files.
• Actions:
  • block: Drops the connection and prevents file delivery.
  • monitor: Logs the event while allowing the file payload to pass.
  • quarantine: Holds a copy of the malicious binary in local FortiGate storage or sends it to FortiAnalyzer.

---

FortiSandbox Integration Architecture

While traditional AV signatures block known threats, sophisticated adversaries craft custom, polymorphic binaries to bypass static pattern matching. FortiSandbox solves this by analyzing file behavior in virtualized sandbox execution environments (Windows, macOS, Linux, Android).

1. Deployment Types

• FortiSandbox Cloud: SaaS-based sandbox hosted in FortiCloud. Integrated natively into FortiGate without dedicated hardware installation.
• FortiSandbox Appliance: On-premise physical or virtual appliance installed inside the enterprise network for high-volume scanning, data sovereignty, and custom OS image testing.

2. Hash Cache Optimization

To minimize bandwidth consumption and eliminate latency for previously inspected files, FortiGate implements a local FortiSandbox Hash Cache:

1. When an unknown binary passes through FortiGate, the AV engine calculates its SHA-256 hash.
2. FortiGate queries the FortiSandbox cache with the hash.
3. If FortiSandbox has already analyzed the file, it instantly returns the cached rating (Clean or Malicious).
4. Only if the hash is unknown does FortiGate upload the complete file payload to FortiSandbox for dynamic execution.

3. Signature Auto-Sync

When FortiSandbox identifies a zero-day file as malicious during dynamic execution, it automatically generates a custom signature hash and pushes it to all connected FortiGates in the Security Fabric, instantly immunizing the infrastructure.

---

Overview Comparison

---

CLI Configuration Examples

Configuring an Antivirus Profile with FortiSandbox Integration

config antivirus profile
    edit "Enterprise_AV_Sandbox"
        set comment "Proxy AV profile with Inline FortiSandbox inspection"
        config http
            set options scan av-monitor
        end
        config smtp
            set options scan
        end
        config ftp
            set options scan
        end
        set mobile-malware-db enable
        set outbreak-prevention block
        set analytics-db enable
        set fortisandbox-mode inline
    next
end

Configuring FortiSandbox System Integration (Cloud or On-Premise)

config system fortisandbox
    set status enable
    set fortisandbox-cloud inline
    set inline-scan enable
    set email "security-admin@example.com"
    set source-ip 0.0.0.0
end