Frequently Asked Questions

• How to configure F-Secure Anti-Virus for Firewalls to protect against the .jpeg vulnerability?
• How I can stop viruses or worms, such as Bagle.F, spreading in password protected ZIP files with F-Secure Anti-Virus for Firewalls?
• I have upgraded F-Secure Anti-Virus for Firewalls but only F-Secure Management Agent is updated to new version. What's wrong?
• A problem when sending larger emails in Checkpoint NG FP3?
• Do you have deployment instruction for Check Point Next Generation (NG)?
• Which F-Secure processes are running using the FSAV for Firewalls?
• How can I check that the Network Connection to the Original MTA is Working?
• How can I check that F-Secure Content Scanner Server is Up and Running?
• What archive file formats does F-Secure Content Scanner Server support?
• Why cannot some web pages be opened with Internet Explorer?
• F-Secure Anti-Virus for Firewalls found virus from a file inside an archive but could not disinfect it. Why?
• SMTP Messages are accumulating in the FireWall-1 spool. Why?
• Why I cannot send SMTP alerts to more than one email address?
• What is the difference between a Content Scanner Server and a Content CVP Server?
• What is the difference between Content Scanner Server and F-Secure Anti-Virus for Microsoft Exchange/Internet Mail/Lotus Domino/Firewalls?
• Which platforms can Content Scanner Server be installed on?
• What is the difference between CVP1 and CVP2?
• Why do you recommend to install the product on Windows NT/2000 Server?
• What protocols can be scanned by this product?
• Does the product have OPSEC certification?
• Can I run any anti-virus programs locally on my F-Secure Content Scanner Server and at the same time have my e-mail traffic protected by F-Secure Anti-Virus for Microsoft Exchange/Lotus Domino/Internet Mail/Firewalls on the same server?
• What happens to e-mails if the F-Secure Content Scanner Server machine is down?
• Do I need to install something on the firewall?
• What about management features? Does the product work with F-Secure Policy Manager?
• Which Service Packs are recommended with CheckPoint Firewall's?
• How can I strip attachments in emails?
• Can I use the same F-Secure Administrator that I am already using with Workstation Suite?
• Can I use the same F-Secure Policy Manager Server that I am already using with Workstation Suite?
• Can F-Secure Anti-Virus for Firewalls detect ActiveX and Java applets for malicious code?
• Do I need to use F-Secure Policy Manager Server or can I use a shared directory (CommDir)?
• Which firewalls does the F-Secure Anti-Virus for Firewalls work with?
• Why do I get 'Connection to Final-MTA failed' error in FireWall-1 log?
• What alerting and reporting features are available?
• Why do I fail to access some web sites when using FSAV for Firewalls?
• How are the virus database updates done?
• When I connect to some sites, I get error message 'Failed connect to www server'. Why?
• Why data trickling does not work although i am followed the instruction of the FSAV for Firewalls Administrator Guide?
• F-Secure Anti-Virus for Microsoft Exchange/Internet Mail/Lotus Domino/Firewalls found a virus in .zip but could not disinfect it. Why?
• Can F-Secure Anti-Virus for Firewalls scan and strip attachments from partial messages?
• Can I use remote installation to install F-Secure Anti-Virus for Microsoft Exchange, FSAV for Internet Mail, FSAV for Firewalls and FSAV for Lotus Domino?
• Can I install CSS to support multiple F-Secure Anti-Virus Mail Server and Gateway products?
• F-Secure Anti-Virus for Firewalls strips the entire message, what is wrong?
• I cannot contact some web or FTP sites. Why?
• I get "Cannot reach the content security server" messages over and over again in FireWall-1 log. What's wrong?
• Slow performance running HTTP scanning. What can be a reason?

This applies to all the versions of F-Secure Anti-Virus for Firewalls on any of the supported platforms.

A security vulnerability related to processing of picture files in the JPG-format has been reported recently. The vulnerability is present in Windows XP (without service pack 2) and Windows Server 2003 operating systems as well as several other products from Microsoft. This vulnerability does not pose an immediate threat to users at the moment. But viruses that use this vulnerability are likely to appear in the future. F-Secure wants to draw your attention to this, as a successful JPG-virus would be unique and break many common believes about how viruses replicate.

Affected file extensions are the following: BMP DIB EMF GIF ICO JFIF JPE JPEG JPG PCX PNG RLE TGA TIF TIFF WMF

F-Secure Anti-Virus for Firewalls can be configured to protect the user against the .jpeg vulnerability with the following settings:

1. SMTP e-mail scanning

• F-Secure Anti-Virus for Firewalls/Settings/Common/SMTP/SMTP Scanning=All Files (default)

2. HTTP scanning

• F-Secure Anti-Virus for Firewalls/Settings/Common/HTTP/HTTP Scanning=All Files with Included Extensions (default)

  Add the list above to the list of included extensions to be scanned:

• F-Secure Anti-Virus for Firewalls/Settings/Common/HTTP/HTTP Scanning/Included Extensions

3. FTP scanning

• F-Secure Anti-Virus for Firewalls/Settings/Common/FTP/FTP Scanning=All Files with Included Extensions (default)

  Add the list above to the list of included extensions to be scanned:

• F-Secure Anti-Virus for Firewalls/Settings/Common/FTP/FTP Scanning/Included Extensions

For more information about the issue, please check the following pages:

General information: http://www.f-secure.com/news/items/news_2004100500.shtml

Technical Description: http://www.f-secure.com/v-descs/ms04-028.shtml

This applies to F-Secure Anti-Virus for Firewalls version 6.20 on all Windows server platforms.

Since it is impossible to scan inside the password protected ZIP files, regular e-mail virus scanner is not able to detect the infections. However, F-Secure Anti-Virus Mail Server and Gateway products can be configured to stop password protected archive files regardless the content of the archive.

In environments managed through F-Secure Policy Manager, change the F-Secure Content Scanner Server/Settings/Virus Scanning/Suspect Password Protected Archives setting to "Treat as Unsafe." You must have the archive scanning enabled to be able to use this setting. Once you've changed the setting, you must distribute the policies to take the setting into use.

In the locally managed environments, select F-Secure Content Scanner Server from the F-Secure Settings And Statistics and go to the Scanning/Advanced page. The same setting can be found there.

• Windows NT Server and Advanced Server, Service Pack 4 or later
• Windows 2000 Server and Advanced Server, Service Pack 1 or later

Note! Files transferred using the HTTPS protocol can not be scanned, as those files are sent encrypted all the way from the web server to the browser.

NOTE! In very large, performance-critical installations, you will benefit from having backup F-SecureContent Scanner Server(s). Backup Content Scanner Servers will be used when the primaryone becomes unavailable. Each F-Secure Content Scanner Server should be installed on a dedicated machine.

• Windows NT SP6
• Windows 2000 Server SP1 or later
• Firewall-1 4.0 SP7 or later (preferably the latest)
• Firewall-1 4.1 SP3 or later
• Next Generation FP1 or later

A2: F-Secure Anti-Virus for Firewalls 5.0 cannot strip attachments in email. However you can configure FireWall-1 to do that. For example, if you want to strip all Word document attachments, you can define a new SMTP resource and define application/msword in Strip MIME of Type (under Action2 tab). Add the new SMTP resource to your rulebase, before anti-virus scanning rule (!) and then install new policies. To strip all executable (EXE, COM, DLL, OCX, VBS, etc.) and office document attachments, you can specify application in Strip MIME of Type.

A3: If you have installed Check Point FireWall-1 4.1 SP3 you have the option to strip certain files based on the file extension. You need to define the extension in /etc/fw/conf/objects.C. Add a forbidden section in the resourcesobj part. In the example below, the resource is named smtp-attachment. Close the firewall GUI before manipulating the objects.C and reinstall the policy after the modification:

 :resourcesobj (resourcesobj 
     : (smtp-attachment 
         :maxsize (1000) 
         :allowed_chars ("8 bit") 
         :av_setting (none) 
         :av_server () 
         :color (blue) 
         :type (smtp) 
         :comments () 
         :err_notify (false) 
         :default_server () 
         :error_server () 
          : (match_from 
             : ("*") 
          ) 
          : (match_to 
             : ("*") 
          ) 
          : (from 
             : () 
          ) 
          : (to 
             : () 
             : () 
          ) 
          : (user_field 
             : () 
             : () 
             : () 
          ) 
         :except_track ("Exception Log" 
             :type (log) 
             :color (Blue) 
             :format (long) 
             :icon (log.pr) 
         ) 
         : (content-type 
             : () 
         ) 
         : (forbiddenfiles 
             : ("{*.vbs,*.exe}") 
         ) 
     ) 
 )

Note: In small environments both the Policy Manager Server and Content Scanner Server may be installed on the same machine, but in general, especially if there is lots of traffic going through the system, this is not recommended.

OPSEC CVP	Generic CVP
Check Point FireWall-1 Sun Solstice FireWall-1	Digital AltaVista Firewall Milkyway Networks Firewall TIS Gauntlet Cyberguard Firewall Secure Computing Firewall Novell FireWALL for NT

Here is what you can do to workaround this problem. You can install a "smart" SMTP server. This SMTP Server can either be inside or outside your firewall, but you have to make sure that any SMTP traffic from this host does not get processed by any SMTP resources. To ensure this doesn't happen when your mail server is inside the firewall, you need to craft your SMTP rules according to the following order:

Source	Destination	Service	Action
Smart-SMTP-Server	Any	SMTP	Accept
Any	Internal-SMTP-Server	SMTP->Inbound_Resource	Accept
Internal-SMTP-Server	Any	SMTP->Outbound_Resource	Accept

The "smart SMTP Server" rule above your other SMTP rules with resources will insure the SMTP Security Server does not get invoked. The Inbound_Resource will be configured per your tastes. The Outbound_Resource will be configured to forward all outbound email to your "smart" SMTP server after scanning. You can do this by setting the "Mail Server" part of the resource to your smart SMTP server's IP address. This will force all outbound email to be forwarded to the Smart SMTP Server, regardless of the actual destination.

If using version 4.1, the firewall's objects.C file needs to be manually edited to force the conversion of HTTP 1.1 packets to HTTP 1.0. To do this:

1. Stop the Firewall-1 service.
2. Edit the file $FWDIR\conf\objects.C.
   After the line
   :props (
   Add the line
   :http_force_down_to_10 (true)
3. Start the FireWall-1 service.
4. Reinstall the security policy.

Also, check the following question.

1. Connection to the site timed out or was refused at the remote end.
2. The remote site either has a missing or inconsistant "reverse DNS" entry for it's IP (thanks to Arjan van der Valk for uncovering this).

Check Point considers the latter a security risk and does not allow these sites to be contacted through the HTTP/FTP Security Server. Check Point also does not allow you to turn this feature off. Your options for working around this are:

1. Contact the remote site in question to ask them to fix their reverse DNS entry
2. Add an entry in your firewall's local host file and have the system resolve against the hosts file first (note: This is untested)
3. Exclude the site in question from going through the security server by adding a rule above your security server rule that permits normal HTTP/FTP to the site.

1. Copy the cvp_attributes utility to the computer running CheckPoint FireWall-1.
2. Create a CVP server attributes file called cvp_server.attr into the same directory where you copied the cvp_attributes utility.
3. Enter the following information in the cvp_server.attr file:
   rply 2
   ftp_use_cvp_reply_safe true
   http_use_cvp_reply_safe true
   smtp 2
   rcpt_to
   mail_from
   
   Note! Make sure that you leave one empty line at the bottom of the cvp_server.attr file.
   Note! Check that you do not have FireWall-1 Policy Editor open before you run cvp_attributes.
   Note! Before running the cvp_attributes utility with version 4.1 of VPN-1/FireWall-1, the $FWDIR environment variable must be defined and set to point to the VPN-1/FireWall-1 installation directory (by default, c:\winnt\fw1\4.1 in Windows).
4. From the command line run the following command:
   cvp_attributes cvp_server.attr
   where is the name of the F-Secure Anti-Virus for Firewalls you have specified in Server Objects in FireWall-1's Policy Editor.
5. Open FireWall-1 Policy Editor and install the policy.
6. Reboot the FireWall-1 computer.

NOTE! F-Secure Anti-Virus for Workstation or Server does not disinfect inside archives automatically. You have to extract it and remove malicious code from it manually.

Install first CSS with the keycode for one product then run the same setup program and enter the keycode for the other product you want the CSS to support to additionally install components required. When running setup.exe for the second time (with the second product's key code), the setup program will ask to confirm the installation of the first product and you just need to enter again the keycode for it.

This (multiple keycodes feature) is supported in CSS 6.01 and later.

Possible reasons:
Connection to the site timed out or was refused at the remote end. The site in question has a faulty or nonexistent entry in the DNS so that the reverse DNS lookups do not work properly. According to Check Point, this may be a security vulnerability and can be circumvented only by adding the site IP addresses and names in question to FireWall-1 machine’s host (\winnt\system32\drivers\etc\hosts) file or – preferably – adding the correct DNS data for those machines.

• The security server in Check Point FireWall-1 has crashed. It may still appear in the Unix process listing as in.aXXXXd, yet it might have been crashed. Stop and start the FireWall-1 (fwstop; fwstart) – sometimes you will need to do a restart.
• There is a network problem between the FireWall-1 and F-Secure Anti-Virus for Firewalls. Check that data can be transferred from FireWall-1 to F-Secure Anti-Virus for Firewalls and vice versa. Check that ping works to both hosts.
• F-Secure Anti-Virus for Firewalls has crashed. Check if F-Secure Management Agent and F-Secure Anti-Virus for Firewalls are running and restart them if necessary.