SRX UTM: Antivirus - Sophos

Here is a quick overview of getting Sophos AV working on an SRX

Sophos is the Cloud based solution and so needs an active Internet connection to work. This means the AV database is not stored locally on the SRX like Kaspersky. The SRX uses DNS queries to the Sophos Cloud to perform AV queries. We'll see later how these work.

Sophos can also perform URI content checking over HTTP to detect malware.This is essentially a reputataion check and can be disabled if you wish.

The Sophos solution should put less load on the SRX, processor and memory wise due to not having to download a giant AV database and run checks against it though it does cache responses to improve lookup performance.

SRX UTM: Antivirus - Kaspersky Full

Today we are going to take a little look at Antivirus on the SRX and testing it to make sure its actually working.

There are currently 3 Antivirus solutions for the SRX all of which require a different license to activate:
* Kapersky
* Sophos
* Juniper Express

Briefly, some differences between the 3 options are:
Kaspersky 
* Full file based AV
* Local signature database lookups. AV signatures downloaded as a package.
* Largest cpu performance impact 
* Supports Intelligent Prescreening

Sophos
* Cloud based signature database which therefore requires..
* Constant Internet access needed for AV lookups.
* Moderate cpu perfomance impact
* No Prescreening 

Juniper Express
* Less protection than the other 2 options 
* Only protects against critical threats. Modified Kaspersky database.
* Does not reconstruct content prior to scanning 
* Pattern matching based solution. No heuristics.
* No protection against polymorphic or metamorphic viruses
* Supports Intelligent Prescreening

* Least cpu performance impact and highest throughput.