AntiVirus II

Uses the full antivirus database :
Normal, extended, or extreme—depending on what is configured in the CLI

Uses the normal antivirus database :
Normal, extended, or extreme—depending on what is configured in the CLI

When the last packet arrives, the AV engine starts the scan.
Files bigger than buffer size are not scanned—can enable logging of these files.
Packets are not delayed by scan—exceptlastpacket.
Lower perceived latency-data loads faster

When the first packet arrives, the AV engine starts the scan.
Files bigger than buffer size are scanned— can´t enable logging of these files.
Packets are not delayed by scan—except first packet.
Faster perceived latency-data loads lower

If a virus is detected, the last packet is dropped and the connection is reset. If an identical request is made, the block replacement page is inserted immediately.

If a virus is detected, the first packet is dropped and the connection is reset. If an identical request is made, the block replacement page is inserted again.

full scan mode
quick scan mode

full scan mode
medium scan mode

True

False

then flow inspection mode is more appropriate. If security is your priority, proxy inspection mode—with client comforting disabled—is more appropriate.

then proxy inspection mode is more appropriate. If security is your priority, flow inspection mode—with client comforting disabled—is more appropriate.

Quick Scan Mode Packet Flow

Full Scan Mode Packet Flow

A. Proxy and NGFW

B. Full and quick

A. Compact

B. Extended