NSE4

Antivirus

Flow based

• Flow-based optimizes compared to proxy inspection
• IPS engine handles the process as a standalone
• Hybrid of scanning modes

Routing / FW

Criteria used to find matching FW policy to process traffic

• Services defined in the FW policy
• Destination defined as internet services in the FW policy
• Source defined as internet services in the FW policy

SSL Inspection

Certificate actions

* Allow
    * The connection is allowed despite the invalid certificate.
* Trust and Allow
    * The certificate is explicitly trusted, and the connection proceeds.
* Block
    * The connection is allowed despite the invalid certificate.

Downloading file from EICAR works when using HTTPS

* Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic
* Website exempt from SSL inspection

Certificates

CA Certificate when used in SSL Inspection

* KeyUsage extension = KeyCertSign
* CA extension = TRUE