WSM User Guide - WatchGuard Technologies

Configuring Gateway AntiVirustoo large or that the Firebox cannot scan. In the Actions section, use the drop-down lists to selectthe Firebox action for each of these conditions:AllowAllow the attachment to go to the recipient, even if the content contains a virus.DropDrop the attachment and drop the connection. No information is sent to the source of themessage.BlockBlock the attachment, and add the IP address of the sender to the Blocked Sites list.Additional actions can be applied to the SMTP proxy:LockLock the attachment. This is a good option for files that are too large for Gateway AntiVirus orthat cannot be scanned by the Firebox. A file that is locked cannot be opened easily by the user.Only the administrator can unlock the file. The administrator can use a different antivirus tool toscan the file and examine the content of the attachment.RemoveRemoves the attachment and allows the message through to the recipient.NoteIf you set the configuration to allow attachments, your configuration is less secure.Creating alarms or log entries for antivirus responsesAn alarm is a mechanism to tell users when a proxy rule applies to network traffic. Use the Alarm checkbox on the General Gateway AntiVirus Settings page to create an alarm for an antivirus response. If youdo not want an alarm for an antivirus response, clear the Alarm check box for that antivirus response. Touse the alarm feature successfully, you must also configure the type of alarm to use in each proxy policy.To configure the alarm type to use, open the proxy policy for edit. In the proxy action category list,select Proxy and AV Alarms.If you want to record log messages for an antivirus response, select the Log check box for the antivirusresponse. If you do not want to record log messages for an antivirus response, clear the Log check box.Configuring GAV engine settings1 From the Gateway AntiVirus dialog box, click Settings.User Guide 311