Description

This article provides information on how Sophos AV (henceforth known as SAV) works, when a DNS error occurs.

Symptoms

  • SAV checks the target file with a DNS query to the Sophos server.
  • It is unable to check any string in the DNS issue.
  • How does it works?

Solution


One DNS server is online; but the SRX device does not have the DNS configuration. Another server has an issue and does not respond; for example, Port Unreachable .

DNS is not configured :

The SRX device does not have a DNS configuration and there is no way to send a DNS query; so the scan engine falls back and the reason is Engine not ready :

root@SRX> run show security utm anti-virus statistics
 UTM Anti Virus statistics:
 MIME-whitelist passed: 0
 URL-whitelist passed: 0
 Scan Request:

  Total Clean Threat-found Fallback
  0               0         0 1

 Fallback: 
 Log-and-Permit Block Permit
  Engine not ready: 0 1 0
 Out of resources: 0 0 0
 Timeout: 0 0 0
 Maximum content size: 0 0 0
 Too many requests: 0 0 0
 Others: 0 0 0

root@SRX>
Increasing the counter is dependent on the configuration for fallback action ( Block/Log and Permit/Permit ). In the mail recipient, UTM changes the subject as configured and sends it to the original mail server or drops the mail and sends a notification to the server. The following example is of a mail to the recipient in the fallback block :.
Subject:
<Original Subject>
Body:
This mail is dropped due to some problem on scan engine
1.2.3.4:36238->10.11.12:13 the scan engine is not ready
The information highlighted in blue is from the custom-message/custom-message-subject configuration. The information highlighted in red indicates the error reason.
If notify-mail-sender is present in the fallback-block of the notification option, UTM also send a notification:
Subject:
Mail Delivery Failure ( This mail is dropped by an error )
Body:
This mail is dropped due to some problem on scan engine
1.2.3.4:36238->10.11.12:13 the scan engine is not ready
The information highlighted in blue is from the custom-message/custom-message-subject configuration. The information highlighted in red indicates the error.

DNS server is unreachable :
The DNS server is configured; but the server is unreachable or unable to response to a query from SRX; so the scan engine cannot receive a DNS response, the scan engine falls back, and the reason is Timeout . 
root@SRX> run show security utm anti-virus statistics
UTM Anti Virus statistics:
MIME-whitelist passed: 0
URL-whitelist passed: 0
Scan Request: 

  Total Clean Threat-found Fallback
       0 0 0 1

 Fallback: 
                              Log-and-Permit Block Permit
 Engine not ready: 0 0 0
 Out of resources: 0 0 0
 Timeout: 0 1 0
 Maximum content size: 0 0                 0
 Too many requests: 0 0 0
 Others: 0 0 0

root@SRX>
Increasing the counter is dependent on the configuration for fallback action ( Block/Log and Permit/Permit ). In the mail recipient, UTM changes the subject as configured and sends it to the original mail server or drops the mail and sends a notification to the server. The following example is of the mail to the receipient being in the fallback block :
Subject:
<Original Subject>
Body:
This mail is dropped due to some problem on scan engine
1.2.3.4:36238->10.11.12:13 is dropped due to AV scan timeout
If notify-mail-sender is present in the fallback block of the notification option, UTM also send a notification: 
Subject:

Mail Delivery Failure (This mail is dropped by an error)
Body:
This mail is dropped due to some problem on scan engine
1.2.3.4:36238->10.11.12:13 is dropped due to AV scan timeout
*The information highlighted is from the custom-message/custom-message-subject configuration. The information highlighted in red indicates the error reason.