This KB article explains the correct procedure to validate the Avira Anti-Virus (UTM AV) engine on Juniper SRX devices using the EICAR test file.

Customers often use eicar.org to verify that the Anti-Virus feature is functioning correctly. However, eicar.org now delivers the EICAR test file over HTTPS, which prevents the SRX from inspecting the downloaded file unless SSL Forward Proxy is configured. As a result, the download may succeed without being blocked, leading to the incorrect assumption that the Avira Anti-Virus engine is not working.

This article describes the correct validation methods for both HTTP and HTTPS traffic.

The Avira Anti-Virus engine can only inspect traffic that is visible to the SRX.

• HTTP traffic: The SRX can inspect the file directly, and no SSL Proxy configuration is required.
• HTTPS traffic: The file is encrypted. The SRX must first decrypt the traffic using SSL Forward Proxy before the Avira Anti-Virus engine can inspect the downloaded content.

If SSL Forward Proxy is not configured, the SRX forwards the encrypted HTTPS traffic without inspection, and the Anti-Virus engine cannot detect or block the EICAR test file.

How to Validate the Avira Anti-Virus Engine

Scenario 1: Testing without SSL Forward Proxy

If SSL Forward Proxy is not configured:

1. Use an HTTP-based EICAR test file source (for example, http://www.csm-testcenter.org/test?do=home).
2. Download the EICAR test file through the SRX.
3. Verify that the SRX blocks the download according to the configured UTM Anti-Virus policy. (show security utm anti-virus statistics)

A successful block confirms that the Avira Anti-Virus engine is functioning correctly.

Scenario 2: Testing with eicar.org

If you want to validate using eicar.org:

1. Configure SSL Forward Proxy on the SRX.
2. Ensure the client trusts the SSL Forward Proxy CA certificate.
3. Download the EICAR test file from https://www.eicar.org.
4. Verify that the SRX decrypts the HTTPS session and blocks the EICAR file according to the configured UTM policy.

Without SSL Forward Proxy, the download from eicar.org will not be inspected because the traffic remains encrypted.