Full Antivirus Application Protocol Scanning

The Full Antivirus Application Protocol Scanning is not supported from Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1 onwards. For previous releases, you can turn antivirus scanning on and off on a per protocol basis. If scanning for a protocol is disabled in an antivirus profile, there is no application intelligence for this protocol. Therefore, in most cases, traffic using this protocol is not scanned. But if the protocol in question is based on another protocol for which scanning is enabled in an antivirus profile, then the traffic is scanned as that enabled protocol.

The internal antivirus scan engine supports scanning for specific Application Layer transactions allowing you to select the content (HTTP, FTP, SMTP, POP3, or IMAP traffic) to scan. For each content type that you are scanning, you have different configuration options.

Profile-based settings, including enable/disable, scan-mode, and scan result handling settings, may not be applicable to all supported protocols. The following table lists profile-based settings and their protocol support.

The HTTP antivirus scanning is not supported from Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1 onwards. For previous releases, if antivirus scanning is enabled for Hypertext Transfer Protocol (HTTP) traffic in a content security profile, TCP traffic to defined HTTP service ports (generally port 80) is monitored. For HTTP traffic, the security device scans both HTTP responses and requests (get, post, and put commands).

For HTTP antivirus scanning, both HTTP 1.0 and 1.1 are supported. If the protocol version is HTTP 0.x , the antivirus scanner attempts to scan the traffic. Unknown protocols are bypassed. For example, some application protocols use HTTP as the transport but do not comply with HTTP 1.0 or 1.1. These are considered unknown protocols and are not scanned.

This is a general description of how HTTP traffic is intercepted, scanned, and acted upon by the antivirus scanner:

1. An HTTP client sends an HTTP request to a webserver or a webserver responds to an HTTP request.

2. The security device intercepts the request and passes the data to the antivirus scanner, which scans it for viruses.

3. After completing the scan, the device follows one of two courses:

   • If there is no virus, the device forwards the request to the webserver.

   • If there is a virus, the device drops the request and sends an HTTP message reporting the infection to the client.

With script-only scanning, the input object is a script file. It can be JavaScript, VBScript, mIRC script, bat scripts (DOS bat files) and other text scripts. The engine matches the input content only with signatures for script files. Script scanning is applicable only for HTML content over the HTTP protocol. There are two criteria for this scan-type. First, the content-type field of this HTML document must be text or HTML. Second, there is no content encoding in the HTTP header. If those two criteria are met, an HTML parser is used to parse the HTML document.

The FTP antivirus scanning is not supported from Junos OS Release 15.1X49-D10 onwards. For previous releases, if antivirus scanning is enabled for File Transfer Protocol (FTP) traffic in a content security profile, the security device monitors the control channel and, when it detects one of the FTP commands for transferring data, it scans the data sent over the data channel.

This is a general description of how FTP traffic is intercepted, scanned, and acted upon by the antivirus scanner:

1. A local FTP client opens an FTP control channel to an FTP server and requests the transfer of some data.

2. The FTP client and server negotiate a data channel over which the server sends the requested data. The security device intercepts the data and passes it to the antivirus scan engine, which scans it for viruses.

3. After completing the scan, the device follows one of two courses:

   • If there is no virus, the device forwards the data to the client.

   • If there is a virus, the device replaces the data with a drop message in the data channel and sends a message reporting the infection in the control channel.

Starting from Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1, only Sophos Antivirus supports the SMTP antivirus scanning. If SMTP (Simple Mail Transfer Protocol) antivirus scanning is enabled in a content security profile, the security device redirects traffic from local SMTP clients to the antivirus scanner before sending it to the local mail server.

Chunking is an alternative to the data command. It provides a mechanism to transmit a large message in small chunks. It is not supported. Messages using chunking are bypassed and are not scanned.

This is a general description of how SMTP traffic is intercepted, scanned, and acted upon by the antivirus scanner:

1. An SMTP client sends an e-mail message to a local mail server or a remote mail server forwards an e-mail message via SMTP to the local mail server.

2. The security device intercepts the e-mail message and passes the data to the antivirus scanner, which scans it for viruses.

3. After completing the scan, the device follows one of two courses:

   • If there is no virus, the device forwards the message to the local server.

   • If there is a virus, the device sends a replacement message to the client.

This topic includes the following sections:

• Understanding SMTP Antivirus Mail Message Replacement
• Understanding SMTP Antivirus Sender Notification
• Understanding SMTP Antivirus Subject Tagging

The POP3 antivirus scanning is not supported from Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1 onwards. For previous releases, if Post Office Protocol 3 (POP3) antivirus scanning is enabled in a content security profile, the security device redirects traffic from a local mail server to antivirus scanner before sending it to the local POP3 client.

This is a general description of how POP3 traffic is intercepted, scanned, and acted upon by the antivirus scanner.

1. The POP3 client downloads an e-mail message from the local mail server.

2. The security device intercepts the e-mail message and passes the data to the antivirus scanner, which scans it for viruses.

3. After completing the scan, the security device follows one of two courses:

   • If there is no virus, the device forwards the message to the client.

   • If there is a virus, the device sends a message reporting the infection to the client.

     See Understanding Protocol-Only Virus-Detected Notifications for information on protocol-only notifications for IMAP.

This topic includes the following sections:

• Understanding POP3 Antivirus Mail Message Replacement
• Understanding POP3 Antivirus Sender Notification
• Understanding POP3 Antivirus Subject Tagging

The IMAP antivirus scanning is not supported from Junos OS Release 15.1X49-D10 and Junos OS Release 17.3R1 onwards. For previous releases, if IMAP (Internet Message Access Protocol) antivirus scanning is enabled in a content security profile, the security device redirects traffic from a local mail server to the internal antivirus scanner before sending it to the local IMAP client.

This is a general description of how IMAP traffic is intercepted, scanned, and acted upon by the antivirus scanner.

1. The IMAP client downloads an e-mail message from the local mail server.

2. The security device intercepts the e-mail message and passes the data to the antivirus scanner, which scans it for viruses.

3. After completing the scan, the security device follows one of two courses:

   • If there is no virus, the device forwards the message to the client.

   • If there is a virus, the device sends a message reporting the infection to the client.

     See Understanding Protocol-Only Virus-Detected Notifications for information on protocol-only notifications for IMAP.

This topic includes the following sections:

• Understanding IMAP Antivirus Mail Message Replacement
• Understanding IMAP Antivirus Sender Notification
• Understanding IMAP Antivirus Subject Tagging
• Understanding IMAP Antivirus Scanning Limitations