Global Policy Exceptions

[Amir_Rehman]

Any idea... How can I add exception for this ? I don't want to bypass the full Antivirus blade for this source.

There is not much information in the log .. Such as MD5 hash, protection name etc.

[TP_Master]

Hi,

You can see the resource name on the upper-right corner. You can add an exception for that.

[tpoole_global]

Use the URL under resource in the top right.

[Amir_Rehman]

Thanks ...

Do you mean I can add domain (.easel.inventable.com) in the exception ?

If yes, I tried to add global exception but could not find Url based domain in the destination field. Only Ip and subnets is the option.

Thanks,

Amir

[TP_Master]

Not in the scope; in the column called "Protection/Blade/Site" -- you need to add the url as a "custom site" in that column (scope can be "Any")

[Amir_Rehman]

Antivirus blade still catches it. Not sure why .

[Timothy_Hall · Accepted solution]

The anti-virus engine is experiencing an internal failure trying to scan that resource, and because the anti-virus blade is set to "fail closed" the resulting action is a Prevent.  Creating an exception for that resource will not help since it only changes the final decision rendered (Prevent/Detect/Inactive) but does not stop the scanning of that resource and therefore the internal failure that is occurring.  It probably has to do with the scanned resource exceeding the fixed size of the SFT buffer on the firewall, please see the following SK for the fix: sk139292: "Failure-reject: unknown error" in Anti-Virus log, traffic fails

[Amir_Rehman]

Thank you for your Help.

Yes sk139292 did work .

# fw ctl set int g_ci_av_sft_classification_buffer_size 15000

Ciao