Virus Protection; Configuring Antivirus Protection - D-Link DFL-500 User Manual

Virus protection

DFL-500 antivirus protection screens the information found in web (HTTP protocol) and email content (SMTP,
POP3, and IMAP protocols) as it passes through the DFL-500. The content can be contained in normal
network traffic that is allowed to pass between DFL-500 interfaces as well as in IPSec VPN traffic.
Antivirus protection screens content traffic for the following types of target files that can contain viruses:
·
Executable files (exe, bat, and com)
· Visual basic files (vbs)
· Compressed files (zip, gzip, tar, hta, and rar)
·
Screen saver files (scr)
·
Dynamic link libraries (dll)
·
MS Office files that contain macros
You can configure antivirus protection to:
·
Block target files
The DFL-500 removes target files and attachments that can contain viruses from content protocol data
streams. You can configure antivirus protection to remove all target files or only selected target file types.
You can also configure antivirus protection to remove different target file types from each content protocol.
Block target files to remove all content that poses a potential threat and provide the best protection from
active computer virus attacks. Blocking target files is also the only protection available from a virus that is
so new that no effective virus scanner protects against it. You would not normally run the DFL-500 with
blocking turned on. However, it is available for extremely high risk situations where there is no other way
to prevent viruses from entering your network.
·
Scan all target files for viruses
The antivirus scanning engine performs signature and macro virus scanning on all target files. If a virus is
found in a file, the virus scanner deletes the file and replaces it with an alert message that is forwarded to
the user. If a virus is not found, the file is forwarded unchanged to the user. Virus scanning prevents
known viruses from passing through the DFL-500 and does not affect virus-free HTTP downloads and
email attachments.
·
Identify and remove files known to be used by worms
For each of the content protocols, you can configure antivirus protection separately for different DFL-500
traffic streams. You can configure the DFL-500 to scan all email from the Internet for viruses and worms
before it is received on your internal network, while providing less protection for traffic between other more
protected networks.
DFL-500 virus and worm protection is transparent to the end user. Client and server programs require no
special configuration, and DFL-500 high-performance hardware and software ensure there are no noticeable
download delays.
This chapter describes:
·

Configuring antivirus protection

·
Worm protection
·
Customize antivirus messages
·
Updating your antivirus database
· Displaying virus and worm lists
Configuring antivirus protection
To begin configuring antivirus protection you:
·
Select the content protocol (HTTP, SMTP, POP3 or IMAP)
DFL-500 User Manual
91