EICAR through Virtual Wire Pair

[DanielFarina]

Grettings,

I'm trying to detect, block and log the EICAR file transfered on diferent protocols (FTP, HTTP and SMB), I've deployed the Checkpoint 1570R on transparent mode by configuring a bridge between 2 interfaces with a laptop on each interface, somehow I'm not being able to block the file despite I think I've properly enabled Antivirus etc.

By the way, in the enviroment where I'm testing this I'm not allowed to access to the internet to update the device, I just want to know if it's an configuration issue. In case it's an issue with updates I would find a way to fix it.

Any advice?

Thanks

[DanielFarina]

Forgot to attach the screenshots 🙂

[PhoneBoy]

Without Internet access, or a Private ThreatCloud appliance, most of the Threat Prevention blades aren't going to work.
That includes AV...and even detecting the EICAR virus, it seems like.
At least that's what I read into the following SK: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Tom_Hinoue · Accepted solution]

Have you tried enabling LAN to LAN inspection?
By default, inspection between internal interfaces is disabled.

Device -> Advanced Settings -> [Stateful Inspection - Perform deep packet inspection on LAN to LAN traffic] -> change the value to [True]

*Note it may impact performance if you have e.g. additional LAN-WAN traffic.

[DanielFarina]

It worked, but just under HTTP. It must be something related to firmware upgrade or internet access. Many thanks!