User manual KERIO TECHNOLOGIES WINROUTE FIREWALL 6 ADMINISTRATOR S GUIDE

[. . . ] Kerio WinRoute Firewall 6 Administrator's Guide Kerio Technologies s. This guide provides detailed description on configuration and administration of Kerio WinRoute Firewall, version 6. 6. 0. User interfaces Kerio StaR and Kerio Clientless SSL-VPN are focused in a standalone document, Kerio WinRoute Firewall -- User's Guide. The Kerio VPN Client application is described in a stand-alone document Kerio VPN Client -- User's Guide. [. . . ] The purpose of the antivirus check is only to detect infected files, it is not possible to heal them!If the antivirus check is disabled in HTTP and FTP filtering rules, objects and files matching corresponding rules are not checked. For details, refer to chapters 12. 2 and 12. 6). Full functionality of HTTP scanning is not guaranteed if any non-standard extensions to web browsers (e. g. download managers, accelerators, etc. ) are used! 2. 3. 172 13. 3 HTTP and FTP scanning To set parameters of HTTP and FTP antivirus check, open the HTTP, FTP scanning tab in Configuration Content Filtering Antivirus. Figure 13. 7 Settings for HTTP and FTP scanning Use the If a virus is found. . . entry to specify actions to be taken whenever a virus is detected in a transmitted file: · Move the file to quarantine -- the file will be saved in a special directory on the WinRoute host. WinRoute administrators can later try to heal the file using an antivirus program and if the file is recovered successfully, the administrator can provide it to the user who attempted to download it. The quarantine subdirectory under the WinRoute directory is used for the quarantine (the typical path is C:\Program Files\Kerio\WinRoute Firewall\quarantine) Infected files (files which are suspected of being infected) are saved into this directory with names which are generated automatically. Name of each file includes information about protocol, date, time and connection number used for the transmission. 173 Chapter 13 Antivirus control Warning When handling files in the quarantine directory, please consider carefully each action you take, otherwise a virus might be activated and the WinRoute host could be attacked by the virus!· Alert the client -- WinRoute alerts the user who attempted to download the file by an email message warning that a virus was detected and download was stopped for security reasons. WinRoute sends alert messages under the following circumstances: The user is authenticated and connected to the firewall, a valid email address is set in a corresponding user account (see chapter 15. 1) and the SMTP server used for mail sending is configured correctly (refer to chapter 18. 3). Note: Regardless of the fact whether the Alert the client option is used, alerts can be sent to specified addresses (e. g. addresses of network administrators) whenever a virus is detected. In the If the transferred file cannot be scanned section, actions to be taken when the antivirus check cannot be applied to a file (e. g. the file is compressed and password-protected, damaged, etc. ): · Deny transmission of the file -- WinRoute will consider these files as infected and deny their transmission. Hint It is recommended to combine this option with the Move the file to quarantine function -- the WinRoute administrator can extract the file and perform manual antivirus check in response to user requests. · Allow the file to be transferred -- WinRoute will treat compressed password-protected files and damaged files as trustful (not infected). Generally, use of this option is not secure. However, it can be helpful for example when users attempt to transmit big volume of compressed password-protected files and the antivirus is installed on the workstations. HTTP and FTP scanning rules These rules specify when antivirus check will be applied. By default (if no rule is defined), all objects transmitted by HTTP and FTP are scanned. WinRoute contains a set of predefined rules for HTTP and FTP scanning. By default, all executable files as well as all Microsoft Office files are scanned. [. . . ] This key is then used to encrypt (symmetrically) the data. Subnet mask Subnet mask divides an IP address in two parts: network mask and an address of a host in the network. Mask have the same form as IP addresses (i. e. 255. 255. 255. 0), however, its value is needed to be understood as a 32-bit number with certain number of ones on the left end and zeros as the rest. [. . . ]