Prevent Virus Attacks by Using J-Web UTM Antivirus

In today’s world, where cyber security threats are evolving and getting more sophisticated, protecting your network from virus attacks is extremely critical. The viruses, worms, and malware perform unwanted and malicious acts, such as damaging or deleting files, hacking personal data, affecting system performance, reformatting the hard disk, or using your computer to transmit viruses to other computers. The UTM antivirus software acts like a first line of defense against such security threats and prevents the spread of viruses into your network. It protects your network from virus attacks, unwanted computer malwares, spywares, rootkits, worms, phishing attacks, spam attacks, trojan horses, and so on.

Juniper Networks offers the following UTM antivirus solutions:

• On-device antivirus protection

  The on-device antivirus is an on-box solution. The on-device antivirus scan engine scans the data by accessing the virus pattern database that is locally stored on the device. It provides a full file-based antivirus scanning function that is available through a separately licensed subscription service.

  Note:

  • The on-device Express or Kaspersky scan engine is not supported from Junos OS Release 15.1X49-D10 onwards; however, it is still applicable for Junos OS Release 12.3X48.

  • Starting in Junos OS Release 18.4R1, SRX Series devices support the Avira on-device antivirus scanning engine.

  • Avira on-device antivirus scanning engine is not supported on SRX300, SRX320, SRX340, SRX345, SRX380, and SRX550 HM devices.

• Sophos antivirus protection

  Sophos antivirus is an in-the-cloud antivirus solution. The virus pattern and malware database is located on external servers maintained by Sophos (Sophos Extensible List) servers. The Sophos antivirus scanner also uses a local internal cache to maintain query responses from the external list server. We offer the Sophos antivirus scanning as a less CPU-intensive alternative to the full file-based antivirus feature.

• The on-device antivirus solution:

  • Scans the application traffic locally without connecting to the server to query whether the application traffic has virus.

  • Minimizes processing delays because the pattern database is locally stored and the scan engine is on-device.

• The Sophos antivirus solution:

  • Avoids downloading and maintaining large pattern databases on the Juniper device because the virus pattern and malware database is located on external servers maintained by Sophos.

  • Improves lookup performance because the Sophos antivirus scanner uses a local internal cache to maintain query responses from the external list server.

  • Effectively prevents malicious content from reaching the endpoint client or server through the use of the Uniform Resource Identifier (URI) checking functionality.

In this section, we present samples of configurations that block virus attacks from the websites defined in this example.

You configure the following UTM configurations at the [edit security utm] hierarchy level.

Creating custom objects at the [edit security utm] hierarchy level:

custom-objects {
    url-pattern {
        av-url-pattern {
            value http://10.102.70.89 ;
        }
    }
    custom-url-category {
        av-url {
            value av-url-pattern;
        }
    }
}

Creating the antivirus profile at the [edit security utm] hierarchy level:

    default-configuration {
        anti-virus {
            type sophos-engine;
        }
    }

    feature-profile {
        anti-virus {
            profile av-profile {
                notification-options {
                    virus-detection {
                    type message;
                    notify-mail-sender;
                    custom-message “Virus-Found!”;
                    custom-message-subject “***Antivirus Alert***”;
                    }
                }
            }
        }
    }

Creating the UTM policy:

utm-policy av-policy {
            anti-virus {
                http-profile av-profile;
                ftp {
                    upload-profile av-profile;
                    download-profile av-profile;
                }
            }
        }

Creating rules for a security policy at the [edit security policies] hierarchy level:

from-zone trust to-zone internet {
    policy av-security-policy {
        match {
            source-address any;
            destination-address any;
            application any;
        }
        then {
            permit {
                application-services {
                    utm-policy av-policy;
                }
            }
        }
    }
}