NSE4

Antivirus

Flow based

• Flow-based optimizes compared to proxy inspection
• IPS engine handles the process as a standalone
• Hybrid of scanning modes

Routing / FW

Criteria used to find matching FW policy to process traffic

• Services defined in the FW policy
• Destination defined as internet services in the FW policy
• Source defined as internet services in the FW policy

SSL Inspection

Certificate actions

• Allow
• The connection is allowed despite the invalid certificate.
• Trust and Allow
• The certificate is explicitly trusted, and the connection proceeds.
• Block
• The connection is allowed despite the invalid certificate.

• Downloading file from EICAR works when using HTTPS
  • Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic
  • Website exempt from SSL inspection