RE: [FW1] AntiVirus solution for FW1?

[Geoffrey Moon <gmoon@FW1-NOSPAMalliedna.com>]

Running Viruswall here, and only two MAJOR complaints. We added the content
management plug-in to Viruswall (eManager) and in our setup we strip
attachments for files types we don't allow (.exe, .vbs, .shs, etc.). The
problem is, Viruswall strips the attachment BEFORE it checks it for viruses,
so you never get virus alerts on infected attachments. No big deal you might
say, since the attachments are stripped anyway, but for me it is a big deal.


First and foremost Viruswall is supposed to be a virus scanner. The fact
that we added the content management plug-in shouldn't defeat the purpose
and functionality of the base product. 

Second, I like the fact that I can have Viruswall automatically send an
email to the sender of an infected file letting them know they sent an
infected attachment, and to please stop sending us mail until the problem's
fixed. Saves me from doing it. 

Third, I never get to see the level of virus activity that's really going
on, since Viruswall isn't reporting infected attachments that I happen to
strip with content management. In other words, unless I start looking at all
of the stripped attachments, I can't really see what infected files are
being sent my way, and even then, if the file isn't something obviously
infected, like veryfunny.vbs, then I don't know if the attachment is
infected or not. Not good when you're trying to get a feel for what's
happening. That was complaint number one.

Complaint number two involves Server Protect (another Trend product) running
on the same machine as Viruswall and eManager. Seems there is no way to
exclude a directory from Server Protect when that directory is accessed with
a UNC name. And guess what, eManager uses UNC names to move infected files
into the Quarantine and mail queue directories. So guess what happens? You
set up Server Protect to exclude all the Viruswall directories, Viruswall
intercepts a virus and moves it to the Quarantine and queue directories, and
blam, Server Protect kicks in and tries to clean the files. So much for
Viruswall functioning properly. We ended up removing Server Protect from the
Viruswall machine.

In Trend's defense, they are looking at both of these issues and I'm hopeful
they will come up with a solution, but I'm also surprised these types of
issues exist in a product so far along the development cycle.

FYI, I also looked as NAV 1.5 and it didn't take long to figure out that it
doesn't work very well. Best I could find (that met my needs) was Trend.

Geoff
 

-----Original Message-----
From: Zinski, Steve [mailto:szinski@richmond.edu]
Sent: Wednesday, November 08, 2000 7:47 AM
To: 'fw-1-mailinglist@lists.us.checkpoint.com'
Subject: [FW1] AntiVirus solution for FW1?



Hello, I posted a message several days ago about problems we are having with
Symantec's Norton AntiVirus for Firewalls (v1.5) working with our FW1. I
received several messages from other people having the same problems which
leads me to believe that Symantec's NAV product is simply not ready for
prime time. :-(

I am working with Trend Micro, maker of VirusWall, to evaluate and possibly
purchase their product. Several people recommend this solution for scrubbing
SMTP traffic at the firewall. Although I do plan to install and test their
30-day eval, I'd like to get the opinion of others who are actually running
Trend's product. Are you satisfied with the performance of VirusWall? Are
there any problems that I should watch out for? Any information would be
greatly appreciated.

Steve Zinski
Senior Network Specialist
University of Richmond, Virginia


============================================================================
====
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
============================================================================
====


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================