Configuring Express Antivirus (J-Web Procedure)

Configuring Express Antivirus Custom Objects (J-Web Procedure)

To configure express antivirus protection using the J-Web configuration editor, you must first create your custom objects (MIME pattern list, URL pattern list, and custom URL category list).

Configure a MIME pattern list custom object as follows:

Select Configure>Security>UTM Custom Objects.
From the MIME Pattern List tab, click Add to create MIME pattern lists.

In the Add MIME Pattern pop-up window, next to MIME Pattern Name, enter a unique name.

Note: Keep in mind that you are creating a MIME whitelist and a MIME exception list (if necessary). Both MIME lists appear in the MIME Whitelist and Exception MIME Whitelist fields when you configure antivirus. Therefore, the MIME list names you create should be as descriptive as possible.

Next to MIME Pattern Value, enter the MIME pattern.
Click Add to add your MIME pattern to the Values list box. Within this box, you can also select an entry and use the Delete button to delete it from the list. Continue to add MIME patterns in this manner.
Optionally, create a new MIME list to act as an exception list. The exception list is generally a subset of the main MIME list.
Click OK to save the selected values as part of the MIME list.
If the configuration item is saved successfully, you receive a confirmation and you must click OK again. If it is not saved successfully, you can click Details in the pop-up window that appears to discover why.

Configure a URL pattern list custom object as follows:

Note: Because you use URL pattern lists to create custom URL category lists, you must configure URL pattern list custom objects before you configure a custom URL category list.

Select Configure>Security>UTM>Custom Objects.
From the URL Pattern List tab, click Add to create URL pattern lists.
Next to URL Pattern Name, enter a unique name. This name appears in the Custom URL Category List Custom Object page for selection.
Next to URL Pattern Value, enter the URL or IP address you want added to list for bypassing scanning.
When entering the URL pattern, note the following wildcard character support:
- The \*\.[]\?* wildcard characters are supported.
- You must precede all wildcard URLs with http://.
- You can only use the asterisk * wildcard character if it is at the beginning of the URL and is followed by a period.
- You can only use the question mark ? wildcard character at the end of the URL.
- The following wildcard syntax IS supported: http://*.juniper.net, http://www.juniper.ne?, http://www.juniper.n??.
- The following wildcard syntax is NOT supported: *.juniper.net , www.juniper.ne?, http://*juniper.net, http://*.
Click Add to add your URL pattern to the Values list box. The list can contain up to 8192 items. You can also select an entry and use the Delete button to delete it from the list. Continue to add URLs or IP addresses in this manner.
Click OK to save the selected values as part of the URL pattern list.
If the configuration item is saved successfully, you receive a confirmation and you must click OK again. If it is not saved successfully, you can click Details in the pop-up window that appears to discover why.

Configure a custom URL category list custom object using the URL pattern list that you created:

Select Configure>Security>UTM>Custom Objects.
From the URL Category List tab, click Add to create URL category lists.
Next to URL Category Name, enter a unique name. This name appears in the URL Whitelist list when you configure antivirus global options.
In the Available Values box, select a URL Pattern List name from the list for bypassing scanning and click the right arrow button to move it to the Selected Values box.
Click OK to save the selected values as part of the custom URL list you have created.
If the configuration item is saved successfully, you receive a confirmation and you must click OK again. If it is not saved successfully, you can click Details in the pop-up window that appears to discover why.

Configuring Express Antivirus Feature Profiles (J-Web Procedure)

After you create your custom objects, configure the antivirus feature profile:

Select Configure>Security>UTM>Global options.
In the Anti-Virus tab, next to MIME whitelist, select the custom object you created from the list.
Next to Exception MIME whitelist, select the custom object you created from the list.
Next to URL Whitelist, select the custom object you created from the list.
In the Engine Type section, select the type of engine you are using. For express antivirus protection, you should select Juniper Express.
Next to Pattern update URL, enter the URL for the pattern database in the box. Note that the URL is http://update.juniper-updates.net/EAV/<device version> and you should not change it.
Next to Pattern update interval, enter the time interval for automatically updating the pattern database in the box. The default for express antivirus checking is once per day.
Select whether you want the pattern file to update automatically (Auto update) or not (No Auto update).
Click OK to save the selected values.
If the configuration item is saved successfully, you receive a confirmation and you must click OK again. If it is not saved successfully, you can click Details in the pop-up window that appears to discover why.
Under Security, in the left pane, select Anti-Virus.
Click Add in the right window to create a profile for the antivirus Juniper Express Engine. To edit an existing item, select it and click Edit.
In the Main tab, next to Profile name, enter a unique name for this antivirus profile.
Select the Profile Type. In this case, select Juniper Express.
Next to Trickling timeout, enter timeout parameters.
Note: Trickling applies only to HTTP. HTTP trickling is a mechanism used to prevent the HTTP client or server from timing out during a file transfer or during antivirus scanning.
Next to Intelligent prescreening, select Yes or No.
Note: Intelligent prescreening is only intended for use with non-encoded traffic. It is not applicable for mail protocols (SMTP, POP3, IMAP, and HTTP POST).
Next to Content Size Limit, enter content size parameters. The content size check occurs before the scan request is sent. The content size refers to accumulated TCP payload size.
Next to Scan engine timeout, enter scanning timeout parameters.
Select the Fallback settings tab.
Next to Default (fallback option), select Log and permit or Block from the list. In most cases, Block is the default fallback option.
Next to Decompress Layer (fallback option), select Log and permit or Block from the list.
Next to Content Size (fallback option), select Log and permit or Block from the list.
Next to Engine Not Ready (fallback option), select Log and permit or Block from the list.
Next to Timeout (fallback option), select Log and permit or Block from the list.
Next to Out of Resource (fallback option), select Log and permit or Block from the list.
Next to Too Many Requests (fallback option), select Log and permit or Block from the list.
Select the Notification options tab.
In the Fallback block section, next to Notification type, select Protocol Only or Message to select the type of notification that is sent when a fallback option of block is triggered.
Next to Notify mail sender, select Yes or No.
If you selected Yes, next to Custom Message, enter text for the message body of your custom message for this notification (if you are using a custom message).
Next to Custom message subject, enter text to appear in the subject line of your custom message for this notification (if you are using a custom message).
In the Fallback non block section, next to Notify mail recipient, select Yes or No.
If you selected Yes, next to Custom Message, enter text for the message body of your custom message for this notification (if you are using a custom message).
Next to Custom message subject, enter text to appear in the subject line of your custom message for this notification (if you are using a custom message).
Select the Notification options cont tab.
In the Virus detection section, next to Notification type, select Protocol Only or Message to select the type of notification that is sent when a fallback option of block is triggered.
Next to Notify mail sender, select Yes or No.
If you selected Yes, next to Custom Message, enter text for the message body of your custom message for this notification (if you are using a custom message).
Next to Custom message subject, enter text to appear in the subject line of your custom message for this notification (if you are using a custom message). The limit is 255 characters.
Click OK.

If the configuration item is saved successfully, you receive a confirmation and you must click OK again. If it is not saved successfully, you can click Details in the pop-up that appears window to discover why.

Note: You create a separate antivirus profile for each antivirus protocol. These profiles may basically contain the same configuration information, but when you are creating your UTM policy for antivirus, the UTM policy configuration page provides separate antivirus profile selection fields for each supported protocol.

Configuring Express Antivirus UTM Policies (J-Web Procedure)

After you have created an antivirus feature profile, configure a UTM policy to which you can attach the feature profile:

Select Configure>Security>Policy>UTM Policies.
From the UTM policy configuration window, click Add to configure a UTM policy. The policy configuration pop-up window appears.
Select the Main tab.
In the Policy name box, enter a unique name.
In the Session per client limit box, enter a session per client limit from 0 to 20000 for this UTM policy.
In the Session per client over limit list, select the action that the device should take when the session per client limit for this UTM policy is exceeded. Options include Log and permit and Block.
Select the Anti-Virus profiles tab.
Select the appropriate profile you have configured from the list for the corresponding protocol listed.
Click OK.
If the policy is saved successfully, you receive a confirmation and you must click OK again. If the profile is not saved successfully, you can click Details in the pop-up window that appears to discover why.

Attaching Express Antivirus UTM Policies to Security Policies (J-Web Procedure)

After you create a UTM policy, create a security policy and attach the UTM policy to the security policy:

Select Configure>Security>Policy>FW Policies.
From the Security Policy window, click Add to configure a security policy with UTM. The policy configuration pop-up window appears.
In the Policy tab, enter a name in the Policy Name box.
Next to Default Policy Action, select one of the following: Deny-All or Permit-All.
Next to From Zone, select a zone from the list.
Next to To Zone, select a zone from the list.
Under Zone Direction, click Add a Policy.
Choose a Source Address.
Choose a Destination Address.
Choose an application by selecting junos-protocol (for all protocols that support antivirus scanning) in the Application Sets box and clicking the —> button to move it to the Matched box.
Next to Policy Action, select Permit.
Note: When you select Permit for Policy Action, several additional fields become available in the Applications Services tab, including UTM Policy.
Select the Application Services tab.
Next to UTM Policy, select the appropriate policy from the list. This action attaches your UTM policy to the security policy.
Click OK.
If the policy is saved successfully, you receive a confirmation and you must click OK again. If the profile is not saved successfully, you can click Details in the pop-up window that appears to discover why.
You must activate your new policy to apply it.