This article explains why UTM Sophos anti-virus can't detect the .zip files and also provides a solution.

Some customers find that UTM Sophos anti-virus can't detect the .zip files.

For more information on configuring Sophos anti-virus, see KB21889 - How to configure Sophos anti-virus on SRX devices [juniper.net] .

Unlike the Juniper Express and Full Antivirus solutions, the antivirus and malware database for Sophos is stored on a group of remote Sophos Extensible List servers. Queries are performed using the DNS protocol.

The DNS request must go via a data plane interface, such as ge-0/0/x, and not the fxp0 interface.

Bad setting example:

name-server {
        8.8.8.8;
        8.8.4.4;
        168.95.1.1;
    }

fxp0 {
        unit 0 {
            family inet {
                address 192.168.1.221/24; <<<<
            }
        }
}
routing-options {
    static {
        route 0.0.0.0/0 next-hop 192.168.1.254; <<<<
    }
}

With the above configuration, the SXL/DNS sent/recv counters look like this:

Change to use one data plane interface to send the DNS request, like ge-0/0/x. Then Sophos anti-virus should detect .zip files, as expected.

• Sophos Antivirus Protection