Firewall Intrusion Prevention Technologies · Topic 2 of 2
Antivirus
Learn viruses, worms and Trojans, the firewall antivirus process, supported protocols, alert, block, declare and delete attachment actions and exceptions.
- 5 min
- A virus needs a host file, a worm spreads by itself, and a Trojan horse disguises itself and does not replicate.
- Firewall antivirus scans files in HTTP, FTP, SMTP, POP3, IMAP, NFS and SMB traffic.
- The process is protocol identification, file type and decompression, signature matching, exception checks, then the response action.
What it is
A computer virus is malicious code that copies itself into files or programs and runs when they are opened. It can damage data, steal information or open a way in for an attacker.
Firewall antivirus scans files as they cross the network, in web downloads, email and file sharing, and stops infected files before they reach the hosts. It works at the network border, so it protects every host behind it, including hosts whose own antivirus software is missing or out of date.
How it works
Malicious code types
| Type | How it spreads | Main harm |
|---|---|---|
| Virus | Attaches to a host file and runs when the file runs | Damages or corrupts files and systems |
| Worm | Copies itself across the network on its own, often through vulnerabilities | Spreads fast and uses up bandwidth and hosts |
| Trojan horse | Pretends to be useful software and does not replicate | Opens a backdoor or steals data |
| Ransomware | Usually arrives by email or an exploit | Encrypts data and demands payment |
Virus names usually follow the form prefix.name.suffix, such as Worm.Sasser.b. The prefix gives the type, such as Worm or Trojan, the name gives the family, and the suffix marks the variant.
Network antivirus versus host antivirus
| Item | Host antivirus | Firewall antivirus |
|---|---|---|
| Where it runs | On each PC or server | On the firewall, for all traffic it inspects |
| What it sees | Files on that host | Files in transit over supported protocols |
| Update effort | Every host must be updated | One signature database on the firewall |
The two work together. The firewall stops known viruses at the border, and host software catches what arrives by other means, such as USB drives or encrypted connections.
Supported protocols
The firewall scans files carried by these protocols:
| Category | Protocols |
|---|---|
| Web | HTTP |
| File transfer and sharing | FTP, NFS, SMB |
| SMTP, POP3, IMAP |
The direction can be upload, download, or both. Encrypted traffic such as HTTPS can be scanned only after the firewall decrypts it.
The detection process
The firewall identifies the protocol and the file transfer, then the file type. It decompresses archives where it can, and matches the file against the virus signature database, which needs a valid license for updates.
If no virus is found, the file is forwarded. If a virus is found, the firewall checks two kinds of exception before it acts.
A virus exception is a whitelist by virus ID, used when a harmless file is falsely detected. An application exception sets a different action for one application carried over a protocol, such as a particular webmail application over HTTP.
Response actions
| Action | Effect | Where it applies |
|---|---|---|
| Alert | Forward the file and log the virus | All protocols |
| Block | Stop the file transfer and log it | Such as HTTP, FTP and SMTP; the actions offered differ by protocol |
| Declare | Forward the email with a notice added that it carries a virus | Email protocols |
| Delete attachment | Remove the infected attachment and add a notice | Email protocols |
Email users still receive the message with declare or delete attachment, so legitimate mail is not lost when only an attachment is infected.
Applying an antivirus profile
Like IPS, antivirus is a profile that a security policy rule references.
profile type av name av_mail
#
security-policy
rule name trust_to_untrust
source-zone trust
destination-zone untrust
action permit
profile av av_mailOnly traffic that the rule permits is scanned. Run engine configuration commit after creating or changing the profile so that it takes effect.
A worked example
Users in the Trust zone download files from the web and receive mail through POP3. The engineer creates an antivirus profile that blocks infected HTTP downloads and deletes infected attachments in POP3 mail, then references it in the Trust to Untrust policy.
An internal tool is reported as a virus by one signature. The engineer adds that virus ID as a virus exception, so the tool downloads normally while other viruses are still blocked.
How the exam asks about this
- "Which antivirus action forwards an infected email but adds a warning to it?" -> Declare.
- "Which type of malicious code spreads across the network by itself without a host file?" -> A worm.
- "Which protocols can firewall antivirus scan?" -> HTTP, FTP, SMTP, POP3, IMAP, NFS and SMB.
What to remember for the exam
- A virus needs a host file, a worm spreads by itself, and a Trojan horse disguises itself and does not replicate.
- Firewall antivirus scans files in HTTP, FTP, SMTP, POP3, IMAP, NFS and SMB traffic.
- The process is protocol identification, file type and decompression, signature matching, exception checks, then the response action.
- Actions are alert, block, declare and delete attachment; the last two are for email.
- A virus exception whitelists one virus ID; an application exception sets the action for one application.
An antivirus profile does nothing on its own. It must be referenced in a security policy rule with the action permit, and the firewall cannot scan encrypted files or HTTPS traffic it has not decrypted.
Common mistakes
Calling every piece of malware a virus. The exam separates viruses, worms and Trojan horses by how they spread and whether they replicate.
Expecting declare to stop the email. Declare forwards the email with a notice; to stop delivery of the file, use block or delete attachment.
Using a virus exception for a whole application. A virus exception allows one virus ID; a different action for one application is an application exception.
Check yourself
What does the delete attachment action do?
It removes the infected attachment from the email, adds a notice, and still delivers the message.
When does the firewall apply a virus exception?
After a virus is detected, if its virus ID is on the exception list, the file is forwarded instead of handled by the response action.
Why should hosts keep their own antivirus software when the firewall scans traffic?
The firewall sees only supported protocols it can read, so files from USB drives or undecrypted encrypted traffic are not scanned.
Topic 2 of 2 in Firewall Intrusion Prevention Technologies
Test yourself on Firewall Intrusion Prevention Technologies
The full Huawei HCIA-Security H12-711 question bank has 600 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Huawei. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.