How To – Evaluate Cyberoam Anti Virus scanning functionality for HTTP protocol
How To – Evaluate Cyberoam Antivirus
scanning functionality for HTTP protocol
Applicable to versions: 9.1.0 build 0 onwards
Objective
Purpose of the document is to help you evaluate Cyberoam’s Antivirus scanning functionality for
HTTP protocol.
How it works
Cyberoam gateway level antivirus solution protects your network from web traffic that carries
harmful and dangerous content such as viruses, worms, or other malware. Cyberoam scans the
web traffic and allows defining scanning policies for the entire network, individual users or groups
of users.
Cyberoam scans the web traffic in real time based on the firewall rules created. If infected content
is found, user is educated in the form of a message, and access to the site is blocked while
Administrator is informed through the Dashboard alert.
Test Environment
In the below given example, Network has Cyberoam deployed in Gateway mode with workstations
and laptops in LAN zone. The external interface connects to the Internet.
Note
•
The IP address scheme used in the network diagram is for the testing purpose only.
•
Minor changes can be found in the screen elements depending on the version of Cyberoam.
How To – Evaluate Cyberoam Anti Virus scanning functionality for HTTP protocol
Configuration
Step 1. Log on to Cyberoam Web Admin Console and add a user from User>User>Add User with
the following parameters:
Parameters
Name
Username
Password and Confirm Password
User Type
Number of simultaneous login(s)
Allowed
Group
Login Restrictions
Value
john
edward
john123
User
Unlimited
Open Group
All Nodes
(Click to select)
Step 2. Create LAN to WAN zone user identity based firewall rule from Firewall>Create Rule with
the following parameters:
Parameters
Source
Check Identity
(Click to Enable)
Destination
Value
Zone - LAN
Host - Any Host
Click User and select the username
Zone - WAN
How To – Evaluate Cyberoam Anti Virus scanning functionality for HTTP protocol
Services/Service Group
Apply Schedule
Action
Apply Source NAT (Click to Enable)
Scan Protocol(s)
Host – Any Host
All Services
All the Time
Accept
MASQ
HTTP
(Click to Enable)
Please make sure that the firewall rule which you created is first in the list of LAN to WAN zone
firewall rules.
Test Results
For end-user
Step 3. Browse to http://<cyberoam ip address:8090> and logon to Cyberoam using the username
How To – Evaluate Cyberoam Anti Virus scanning functionality for HTTP protocol
and password as specified in step 1.
Step 4. Browse to http://www.eicar.org/anti_virus_test_file.htm and try to download the virus for
testing purpose.
NOTE - This is not an actual virus. “Eicar” is an industry standard non-viral test file that is
identified by many anti-virus products as a test virus.
Cyberoam will display the below given message:
For Cyberoam Administrator
Step 5. Log on to the Cyberoam Web Admin console with administrator username and password,
and check the Dashboard section ‘Recent HTTP Viruses detected’ for the virus detection details
like date and time of virus detection, the virus name and user who has tried to download the virus
infected file.
How To – Evaluate Cyberoam Anti Virus scanning functionality for HTTP protocol
Click to view the
virus details
Receiving a different result
Note: User based report is generated as user based identity firewall rule is created for user.
To generate the IP address based reports, create general firewall rule instead of user based
identity firewall i.e. do not enable Identity check in the firewall rule.
Document version – 1.0-10/08/2007
">
