Firmware version supported: 4.5 and above

Gateway antivirus scanning inspects files as users download them over the web and blocks infected content at the network perimeter, before it reaches the endpoint. This document explains how to enable antivirus scanning for browsing (HTTP and HTTPS) traffic on your GajShield Next Generation Firewall.

Prerequisites

Requirement Details
Licence A valid Antivirus subscription must be active on the appliance. Check under Licensing before you begin.
Firmware 4.5 or above.
Signature updates The appliance must be able to reach GajShield update servers so virus signatures stay current.
SSL inspection Required for scanning HTTPS traffic. Without it, only plain HTTP downloads are scanned. See the note below.
Access Administrator login to the firewall management console.

Important: Most web traffic today is HTTPS. If SSL deep inspection is not enabled, the firewall cannot see inside encrypted sessions, and antivirus scanning will apply only to HTTP downloads. Enable SSL inspection first if you want full coverage.

Before you enable SSL decryption: When the firewall decrypts HTTPS sessions, it re-signs each site's certificate with its own CA. Unless that CA certificate is installed in the trust store on every client machine, users will see a certificate warning on every HTTPS site they visit, and applications that pin certificates or validate strictly may simply fail to connect.

Import the firewall's CA certificate on all user systems before enabling SSL decryption — via Active Directory Group Policy for domain-joined Windows machines, or through your MDM for mobile and unmanaged devices. Plan this as part of the rollout rather than afterwards; enabling decryption without it will generate a wave of support calls within minutes.

Step 1: Verify the antivirus licence and signature status

Log in to the firewall management console and confirm that the Antivirus subscription is active and not expired, and check the date of the last successful signature update. An appliance with an expired subscription will continue to pass traffic, but will stop receiving new signatures.

Step 2: Enable virus scanning for browsing traffic

  1. In the firewall management console, go to Browsing → Setup → Browsing Options.
  2. Select the Enable Virus Scanning checkbox.
  3. Save the configuration.

Once enabled, virus scanning becomes available for browsing traffic. It is applied to the traffic matched by firewall rules that use the Browse service, as described in the next step.

Step 3: Use the Browse service in your firewall rules

Enabling the checkbox alone does not scan anything. Traffic is inspected only when it is matched by a firewall rule whose service is set to Browse.

  1. Go to your firewall rules and open the rule that allows your LAN users out to the internet for web access.
  2. Set the service to Browse.
  3. Save the rule.

If different departments need different handling, create separate rules — users whose browsing traffic is permitted by a rule using some other service definition will not be scanned.

Step 4: Install policies

Changes do not take effect until they are installed. Go to Firewall → Policies → Install policies and install. Traffic is not affected during this step, but the new scanning behaviour starts only after it completes.

Step 5: Test the configuration

Use the EICAR test file — an industry-standard harmless string that every antivirus engine is required to detect — to confirm scanning works without exposing your network to real malware.

  1. From a client machine behind the firewall, browse to https://www.eicar.org/download-anti-malware-testfile/ and attempt to download the test file.
  2. The download should fail and the firewall should present a block page.
  3. Confirm the detection appears in the antivirus logs on the appliance.

If the HTTP version is blocked but the HTTPS version downloads successfully, SSL inspection is not applied to that traffic — revisit the prerequisite above.

Optional: Bypass scanning for specific domains

If a trusted internal or partner site is being incorrectly blocked, or scanning large files from it causes unacceptable delay, add the domain under Trusted Domains. Traffic to domains listed there bypasses the virus scanning engine.

Use this sparingly. Every entry is a permanent hole in your scanning coverage, and a trusted site that is later compromised becomes a delivery path straight to your endpoints.

Troubleshooting

Symptom Likely cause and fix
Infected files still reach clients over HTTPS SSL deep inspection is not enabled, or the site is excluded from inspection. Verify inspection applies to that rule.
Certificate warnings on every HTTPS site after enabling decryption The firewall's CA certificate is not installed in the client trust store. Deploy it via Group Policy or MDM.
Nothing is being scanned at all Confirm Enable Virus Scanning is still selected under Browsing → Setup → Browsing Options, that the firewall rule carrying the traffic uses the Browse service, and that policies were installed afterwards.
Legitimate downloads blocked as infected Check the antivirus log for the detection name. If it is a false positive, report it to GajShield support and use a trusted domain entry as a temporary workaround.
Detections stopped appearing Verify the subscription has not expired and that the appliance can reach the update servers.