Configure and test Sophos Firewall malware scanning

Sophos Firewall malware scanning checks files in web traffic using the integrated antivirus engines. Enabling web filtering or selecting a Web Policy is not enough: The corresponding firewall rule must use Scan HTTP and decrypted HTTPS, and encrypted traffic must be decrypted before its content can be inspected.

This article focuses on downloads over HTTP and HTTPS. For categories, URL Groups, and user rules, see Web Protection with Web Policies. Zero-Day Protection can additionally analyse unknown files, while email traffic is protected separately through Mail Protection.

Clarify scope, prerequisites, and licenses

Classic malware scanning is bound to protocols and rules. Web downloads require Web Protection; the Base License alone does not include Web Malware Protection. Zero-Day Protection is a separate subscription that complements, rather than replaces, antivirus scanning. SMTP, POP3, and IMAP require Email Protection. Check the actual status and expiry date under Administration > Licensing; the required module must show Subscribed or Evaluating. An internet-connected firewall synchronizes licenses automatically every 24 hours. If the status appears stale, Administration > Licensing > Synchronize forces a refresh.

Meet these prerequisites before making changes:

• Record the firewall rule, its Rule ID and position, and the current state of its scanning options.
• For HTTPS, decide whether DPI Engine or Web Proxy performs decryption, and make sure the test client trusts the Signing CA in use.
• Identify Web Exceptions and SSL/TLS Exclusion Rules that apply to the test path.
• Prepare an isolated test client, a maintenance or pilot window, and access to Log Viewer.
• Create a current backup under Backup and firmware > Backup and restore. Also record the few affected values so a rollback does not unnecessarily restore the entire configuration.

FTP and email use different controls from web traffic. Turn on Scan FTP for malware in the matching firewall rule; its global limit is Web > General settings > Maximum file scan size for FTP. For email, select the protocols actually used—IMAP, IMAPS, POP3, POP3S, SMTP, and/or SMTPS—at the end of the firewall rule; Add ports adds missing standard ports. MTA and Legacy policies, quarantine, and attachment actions are then managed under Email. The primary email scanner is under Email > General settings > Malware protection. These separate paths are delimited here; their complete setup belongs in the linked Mail Protection article.

File-type controls are not proof of a virus detection either. A Web Policy can allow or block downloads by file type, and an email policy can act on attachments. Only a correlated Malware log entry proves that the antivirus scanner detected the content.

What must work together for effective scanning

The result depends on several layers:

• The correct firewall rule must actually match the client traffic.
• Scan HTTP and decrypted HTTPS enables malware scanning for that rule path.
• Web > General settings determines the engine, scanning behaviour, size limits, and how unscannable content is handled.
• HTTPS content is only inspected when DPI or Web Proxy decrypts the connection.
• Web Exceptions must not unintentionally bypass malware scanning.
• QUIC must be controlled because QUIC traffic cannot be scanned like traditional HTTP and HTTPS.

A Web Policy and malware scanning perform different tasks. The Web Policy decides, for example, how to handle categories or file types. The antivirus scan inspects file content for known malware and PUAs. Malware scanning can therefore be active in a firewall rule even with Web policy: None. Conversely, selecting a Web Policy does not automatically mean that downloads are scanned for malware.

Choose single or dual engine

The primary antivirus engine is set under System services > Malware protection. Sophos Firewall uses Sophos and Avira; the selected Primary Engine scans by itself with Single engine and scans first with Dual engine. Sophos is the Primary Engine by default.

The global selection for web traffic is located under:

Web > General settings > Malware and content scanning

• Single engine: Uses only the Primary Engine. This requires fewer resources and offers the best performance. For Zero-Day Protection, Sophos must be the Primary Engine.
• Dual engine: Uses the primary engine first and then the second engine. This increases detection coverage but requires more time and resources.

For Zero-Day Protection, select either Single engine with Sophos as Primary Engine or Dual engine.

For normal client networks, Single engine with Sophos as Primary Engine is a reasonable starting point when throughput and latency are important. Dual engine is appropriate when maximum detection coverage has higher priority and the appliance can handle the additional load under real conditions. The decision should not be based only on data-sheet values: A pilot with typical downloads, video conferences, and software distribution shows the actual impact more reliably.

⚠️ Changing the Primary Engine or switching from Single to Dual has a global effect on matching scan paths. Before making a change, account for existing web, FTP, and mail policies as well as Zero-Day Protection, and document a rollback path. Changing the global primary antivirus engine may also change a locally specified antivirus engine. Review local engine selections after the change.

Control machine learning detection in the scan engine

SFOS 22 can enable machine learning, or ML, globally for the Sophos scan engine and then separately for feature groups. ML looks for suspicious patterns that may not yet exist in the signature database. It extends detection for new or fast-spreading threats, but also increases the risk of false positives.

The commands in this section belong in the Device Console (option 4 in the CLI main menu), not the Advanced Shell or the test client’s terminal. First record the current state with the read-only command:

show scanengine

The documented defaults are ml_scan on globally, ml_web_detection off for Web Proxy and DPI Engine, ml_email_detection on for Email, and ml_legacy_detection off for WAF and FTP proxy. When global ml_scan is off, ML can’t be enabled effectively for the individual feature groups. The feature switches determine whether an ML detection can trigger a block action there.

The following lines show the syntax of commands that change settings, not a checklist to run as written. Before making a change, record the previous values and the affected feature groups. Replace <on|off> with exactly on or off, and <1-128|default> with a valid number or default. Do not enter the placeholders literally:

set scanengine ml_scan <on|off>
set scanengine ml_web_detection <on|off>
set scanengine ml_email_detection <on|off>
set scanengine ml_legacy_detection <on|off>
set scanengine thread_count <1-128|default>

thread_count applies per scan engine. The range is 1 to 128; default calculates the number dynamically from the available CPUs. A fixed thread count isn’t adopted as general performance tuning. It requires reproducible scanner load, CPU and memory measurements, a throughput test, and usually specific support guidance. The older max_buffer_size option is deprecated and isn’t changed.

⚠️ ML may incorrectly block legitimate files or traffic, and ML detections generate telemetry for Sophos Labs. Activation, privacy, affected data paths, and the false-positive process are therefore clarified before rollout; disabling ML globally on suspicion is no cleaner than an unverified allow exception.

The pilot starts with exactly one feature group and a controlled client or mail flow. Compare show scanengine, policy, block action, Log Viewer, application result, CPU, and scan time before and after. EICAR confirms normal malware scanning but doesn’t prove ML detection of a new pattern. Rollback restores the values recorded with show scanengine and isn’t blindly equated with product defaults.

Define scanning behaviour

In addition to the engine, further protection decisions are configured under Web > General settings.

Unscannable content

Action on malware scan failure defines what happens to content that cannot be inspected completely. This can occur with encrypted or damaged archives and files nested too deeply. Sophos Firewall scans archives up to 16 compression levels.

Block offers stronger protection but can stop legitimate password-protected or defective files. Allow preserves the business process but permits uninspected content. Block is the safer starting point for normal client networks. If this disrupts a business application, investigate the specific file path before relaxing the global setting.

File sizes and streaming

Do not scan files larger than sets the maximum scan size for HTTP and HTTPS in MB. Larger files are not scanned. For compressed files, the archive size counts, not the potential size after extraction. FTP has a separate limit in MB under Maximum file scan size for FTP. FTP files above that limit are also not scanned.

A small limit does not automatically improve security because it can allow large installers or archives to pass unscanned. A very high value, however, can increase download times and resource consumption. The value must therefore match software distribution, update packages, and appliance performance.

Under Web > General settings, open Advanced settings to access Scan audio and video files. Scan audio and video files extends scanning to media content but can impair streaming. Enable the option only when the protection requirement justifies the additional load and possible interruptions. After selecting the desired web scanning settings, click Apply to save the changes.

Handle PUAs

Block potentially unwanted applications prevents downloads of potentially unwanted applications (PUAs). These programs are not necessarily malware but may include adware, unwanted remote control, or risky system changes. PUAs listed under Authorized PUAs are exempt from this PUA blocking. Add an entry under Authorized PUAs only after checking the file, source, purpose, and owner. A blanket approval weakens protection for all matching scan paths.

XML API: map scan values safely

For automation, a distinction must be made between global engine selection, web protection values and proxy operation. The mappings below describe the SFOS 22/23 XML structure. Build-specific fields must be resolved before constructing a request. They replace neither the firewall rule nor HTTPS decryption. Before implementation, the API help for the firmware in use and the currently saved values must be checked; documented defaults are neither rollout recommendations nor rollback targets.

Engine, web protection and protocol limits

• Global engine: MalwareProtection contains PrimaryAntiVirusEngine. The documentation specifies Sophos as the default and shows Sophos/Avira as a choice in the sample, not as a literal combined value to send. This is the global primary engine selection, not the Single/Dual switch in the global web scan setting. As described above, changing it may also affect local engine selections; web, FTP and mail policies must be checked afterwards.
• HTTP/HTTPS configuration: AntiVirusHTTPsConfiguration directly contains ScanMode, FileSizeThreshold, AudioVideoFileScanning and PUADetection. By contrast, the nested parent node HTTPSConfigurations contains HTTPSScanningCA, DenyUnknownProtocol, AllowInvalidCertificate and NoHttpsNotification. These children do not belong directly under AntiVirusHTTPsConfiguration. The parameter table marks ScanMode, FileSizeThreshold, AudioVideoFileScanning and HTTPSScanningCA as mandatory fields. ScanMode lists RealTime and BatchMode; this mapping applies to the proxy scan mode explained in the HTTPS section, not as a way to switch DPI to batch mode.
• Broader web protection configuration: WebFilterProtectionSettings shows the HTTPS fields directly under this parent node, without HTTPSConfigurations. The sample also contains FTPFileSizeThreshold, PharmingProtection, Scanning, BlockUnscannableContent and PUAWhitelist with repeatable PUA entries. Scanning selects Single or Dual, not the primary engine; the documented values are Single Anti-Virus (Maximum Performance) and Dual Anti-Virus (Maximum Security). BlockUnscannableContent corresponds to the handling of unscannable content; the table lists Allow and Block (Best Protection). The PUA list contains permitted PUAs when PUA detection is active. The two web parent nodes are therefore not interchangeable wrappers for the same request.
• Size limits: FileSizeThreshold applies to HTTP/HTTPS, while FTPFileSizeThreshold applies separately to FTP. The API documents both in KB, not in the MB used in the UI described above. For both, it specifies integers from 1 to 1572864 and the documented default 1024. The intended target value must be applied using the correct unit, not copied from the UI without checking. The separate FTP operation uses AntiVirusFTP with the mandatory field FileSize, also in KB and with the same documented range and default. Files above the respective protocol limit are not scanned; none of these size values enables Scan FTP for malware in a rule.

⚠️ The samples are not ready-to-copy payloads: for AudioVideoFileScanning, both web samples show Enable/Disable, whereas the parameter tables list on/off. Samples and tables are not consistently aligned for other switches either; for example, BlockUnscannableContent shows Enable/Disable in the sample, but the action values listed above in the table. For PUADetection, unresolved $ANTIVIRUS{PUA_DETECTION_ENABLE} and $ANTIVIRUS{PUA_DETECTION_DISABLE} symbols appear. Neither aliases nor missing Disable values may be inferred from these. Before any production write operation, the valid form for the specific firmware must be established. Globally allowing invalid certificates is not a solution to a CA trust problem.

According to the source description, DenyUnknownProtocol is intended to block invalid traffic through the HTTPS port. In AntiVirusHTTPsConfiguration, the field sits under HTTPSConfigurations: the sample shows Enable/Disable and the table gives the default as Disable, but lists only on as an allowed value; no form for disabling it is provided. In WebFilterProtectionSettings, the field sits directly under the parent node: here too, the sample shows Enable/Disable and the table gives the default as Disable, but lists on and the unresolved symbol $ANTIVIRUS{DENY_PROTOCOL_DISABLE} as allowed values. Neither operation therefore has an established usable form for disabling the setting. Neither off nor Disable nor any other aliases may be used as write values without confirmation for the installed build.

According to the source description, AllowInvalidCertificate controls permission to access websites with an invalid SSL certificate. Both in AntiVirusHTTPsConfiguration under HTTPSConfigurations and directly under WebFilterProtectionSettings, the sample shows Enable/Disable, whereas the table lists on/off as allowed values and Enable as the documented default. These conflicting representations remain unresolved: they establish neither confirmed equivalence nor a valid form to write to the firmware, and do not imply a recommendation to allow invalid certificates. The documented default says nothing about the device’s current state.

Change proxy operation only when necessary

WebFilterAdvancedSettings is a separate parent node for proxy operating values, not an additional malware scanning switch:

• WebCaching controls the web content cache with the documented values Enable and Disable. Caching is assessed only for the proxy path actually in use, not as general-purpose DPI or scanner tuning.
• WebProxyPort is the listener port when the firewall acts as a Web Proxy Server. The API specifies 1 to 65535 and the documented default 3128. A change may disrupt existing client or PAC configurations; it is not a general throughput tip. Client migration and rollback must be planned using the Direct Web Proxy.
• WebProxyMinimumTLSVersion sets the minimum version for Web Proxy and Captive Portal, not for all DPI connections. The API table lists TLS 1.0, TLS 1.1, TLS 1.2 and the documented default TLS 1.1; this list is not a recommendation to allow old TLS versions. Before making a change, firmware support, security requirements and affected clients must be checked.
• TrustedPorts contains repeatable Port entries for accessing websites on non-standard ports. These are not additional listeners or a blanket authorisation of firewall services. Only destination ports that are actually required may be added, with justification.

For a change, exactly one set of values must be selected and backed up beforehand. After saving, the saved values must be read back and compared with the target; a successful API response alone proves neither effective scanning nor client connectivity. This is followed by a normal download, the isolated EICAR test described below and, for proxy changes, additional client/PAC and Captive Portal checks. If errors occur, the actual saved state must be checked first, rather than blindly writing again or changing the engine, listener and protection policy simultaneously. Rollback restores only the affected values that were backed up.

Enable malware scanning in the firewall rule

The rule is located under:

Rules and policies > Firewall rules

For a typical client internet rule, check the following under Web filtering:

1. Source zone and Source networks correspond to the client network.
2. Destination zone is WAN, and the Services cover the intended web traffic.
3. Log firewall traffic is enabled.
4. Scan HTTP and decrypted HTTPS is enabled.
5. Block QUIC protocol is enabled if web traffic should use the controlled TCP path.
6. DPI or Web Proxy has been selected deliberately.
7. Use Zero-day protection is additionally enabled only if unknown files should be analysed.

A compact rule example:

Rule name: LAN_USERS_WEB
Source zones: LAN
Source networks and devices: LAN_CLIENTS
Destination zones: WAN
Destination networks: Any
Services: HTTP, HTTPS
Web policy: LAN_STANDARD_WEB
Scan HTTP and decrypted HTTPS: On
Block QUIC protocol: On
Use web proxy instead of DPI engine: Off
Log firewall traffic: On

The example uses the DPI Engine. LAN_USERS_WEB, LAN_CLIENTS, and LAN_STANDARD_WEB are example names to replace with your own objects. For malware scanning alone, Web policy may also be None. Services should contain only the protocols you need; Any would be broader than necessary for this web example. A broader rule above LAN_USERS_WEB may process the traffic first, so Rule ID and rule order must always be part of acceptance testing. Understanding and building firewall rules correctly explains the fundamentals.

Complete HTTPS with DPI or Web Proxy

Scan HTTP and decrypted HTTPS does not decrypt HTTPS itself. The option only scans unencrypted HTTP and HTTPS content that another part of the configuration has already decrypted.

DPI Engine

With the DPI Engine, decryption is configured under:

Rules and policies > SSL/TLS inspection rules

A matching SSL/TLS inspection rule must apply to the test client and destination and use Action: Decrypt. Clients must trust the Signing CA in use. Roll out TLS Inspection step by step covers planning, the pilot, and exceptions; certificate distribution is explained in Install the CA certificate for HTTPS scanning.

Web Proxy

For the proxy path, enable Use web proxy instead of DPI engine and, for HTTPS, Decrypt HTTPS during web proxy filtering in the firewall rule. Under Web > General settings, the proxy can then scan in two modes:

• Batch: Downloads the complete file to the firewall first and only passes it on after scanning. This provides stricter inspection but can noticeably delay downloads.
• Real-time: Passes parts of the download onward but only completes the transfer after the content has been assessed as clean.

With Batch, the upstream download to the firewall can use the full bandwidth and affect other web requests. In the general proxy scanning path, Traffic Shaping is applied when content is passed to the browser in both Batch and Real-time; this is not a promise to limit that upstream batch download. Direct Web Proxy has an explicit exception: a Traffic Shaping Policy does not apply to that path. Before changing the scanning mode, document the previous value; use the same representative downloads to compare WAN utilisation, client download time, scan result and Rule ID. If a regression occurs, restore the previous scanning mode rather than changing the engine or policy at the same time.

The DPI Engine always operates in Real-time mode. Do not switch between Proxy and DPI merely because of one isolated issue, as their feature sets, ports, logs, and user behaviour differ.

The choice between Real-time DPI, Batch or Real-time proxy scanning, and the safe pilot change are covered in Choose DPI Engine or Web Proxy correctly.

Control exceptions and QUIC

A Web Exception can bypass Malware and content scanning. For matching traffic, this also automatically bypasses Zero-Day analysis. Exceptions should therefore have a narrow host or URL scope, a clear owner, and a review date.

QUIC, or HTTP/3, generally uses UDP 443. Sophos Firewall cannot scan this traffic like traditional web traffic. Block QUIC protocol blocks outbound UDP on ports 80 and 443 in the corresponding firewall rule so that compatible clients fall back to TCP and HTTPS. Background information and tests are available in Block QUIC and HTTP/3 correctly.

Test operation safely

A green Policy Test or an enabled checkbox does not prove that content is being inspected. The test must originate from a client behind the affected firewall rule; a download directly from the firewall checks a different traffic path.

To verify the Sophos Firewall web path, use the specific Anti-virus EICAR test action on the SophosTest page for Web Security. To test transport of the standardized test file independently of that test site, use one variant of the EICAR Anti-Malware Test File instead. EICAR is not real malware, but antivirus products deliberately detect it as if it were malware. Never introduce real malicious software into a production network, and do not open or execute the test file.

Practical procedure:

1. Define an isolated test client and the expected firewall Rule ID. This test does not require a temporary allow exception. If endpoint protection acts first, do not disable it; treat the result as inconclusive for the firewall instead.
2. Record the time, client IP, selected test URL, and expected scan path.
3. Open the Firewall, SSL/TLS inspection, Web filter, and Malware modules in Log Viewer.
4. For HTTPS, verify that the connection is actually processed with Decrypt.
5. Run Anti-virus EICAR test on SophosTest or download exactly one EICAR variant. The expected result is for the firewall to interrupt the transfer before the download completes.
6. Verify that the Malware log shows an antivirus detection for the same client, Rule ID, URL, and time.
7. Close the test page and remove any partial or test file and browser-cache artifact according to the endpoint procedure; do not restore or execute a quarantined object. Revert temporary test settings and confirm with a normal download that web access still works.

A block page alone is not enough. The Web Policy, a file type rule, an endpoint product, or the category of the test site itself may also cause a block. The correlated Malware entry from the firewall is decisive. In Syslog, a web malware detection appears with log_type="Anti-Virus"; depending on the protocol, the components are HTTP or HTTPS, and the Subtype for a detection is Virus.

If Log Viewer does not clarify whether the local antivirus service is operating, its service log can additionally be observed in the Advanced Shell during a controlled test:

tail -f /log/avd.log

Press Ctrl+C to stop the display. avd.log helps with service and engine failures but does not replace policy and connection data in Log Viewer. A quiet file likewise does not prove that scanning is inactive. Sophos Firewall services and logs explains the log mapping.

Troubleshoot common errors methodically

• Web Policy active but no malware inspection: Scan HTTP and decrypted HTTPS is missing from the firewall rule that actually matches.
• HTTP test works, HTTPS test does not: The SSL/TLS inspection rule does not match, does not use Decrypt, or Web Proxy does not decrypt HTTPS.
• Browser uses another path: QUIC is allowed or another firewall rule matches first.
• File is not scanned despite the correct rule: A Web Exception bypasses Malware and content scanning, or the file exceeds the configured size limit.
• EICAR is blocked, but not by the firewall: Endpoint protection, a file type rule, or a web category acted first. Check the firewall Rule ID and Malware log.
• Legitimate archives are blocked: Check Action on malware scan failure, encryption, corruption, and nesting. Do not immediately change the global setting to Allow.
• Dual Engine slows downloads: Compare appliance load, file sizes, concurrency, and Proxy or DPI mode with Single Engine in a controlled pilot.
• Zero-Day Protection shows nothing: Check classic malware scanning, HTTPS decryption, file type, exceptions, and Use Zero-day protection separately.
• A scanning option is missing or cannot be saved: Check the status and expiry of Web Protection, Email Protection, or Zero-Day Protection under Administration > Licensing, then synchronize the licenses. Do not work around this with a broader allow rule.
• An FTP file is not scanned: Check the matching Rule ID, Scan FTP for malware, service, and Maximum file scan size for FTP together. The HTTP/HTTPS switch does not enable FTP scanning.
• An email attachment is not detected: First identify the actual mail path: MTA, Legacy SMTP, or POP/IMAP. Then correlate the protocols and ports selected in the matching firewall rule, the applicable email policy, Single/Dual Antivirus, exceptions, and Mail or Malware logs.

Log Viewer, Policy Tester, and Packet Capture show which firewall rule and policy actually apply.

Roll back changes while preserving state

A rollback restores only the values changed during the pilot. Restore the recorded settings in reverse order: the SSL/TLS inspection rule and its position, the firewall rule with its Rule ID and position, the Proxy/DPI choice, scanning and QUIC switches, the global Single/Dual Engine selection, and the values from show scanengine. Do not delete a firewall rule or disable malware scanning globally because one download fails.

Save the configuration and repeat two checks: a normal representative download must work, and the isolated EICAR test must show exactly the expected pre-change behaviour. If the Rule ID, decryption status, or log action differs from the baseline, the rollback is not complete. The full backup is the emergency path for a wider misconfiguration, not the first response to one checkbox.

Special case when upgrading to SFOS 22.0 GA

A narrowly scoped upgrade issue for SFOS 22.0 GA Respin Build 411 is documented under NC-177529. During this upgrade, messages such as Malware Unscannable may appear temporarily, often for www.msftconnecttest.com. At that moment, the new Sophos scan engine is not yet available when it is the only engine selected in Single Engine mode. Legacy Web Proxy then displays block pages, while page loads can fail with the DPI Engine; the interruption may last approximately one minute longer. Before every upgrade, also verify the current maintenance release and supported upgrade paths; the linked upgrade check covers this version-dependent verification.

Administrators upgrading specifically to this GA version switch from Single engine to Dual engine under Web > General settings before the upgrade and return to the previously used Single engine after the upgrade has completed. This temporary measure is not a general recommendation for MR1, MR2, or later releases. SFOS 22 upgrade check describes the complete upgrade path and other blockers.

FAQ