This article aims to clarify the differences between the UTM antivirus options (Sophos and Avira) and the Flow-Based Anti-Virus options available to Juniper customers.

Using commands meant for one antivirus type when a license for another antivirus type is present can yield unexpected results and cause confusion.

If you are using UTM, you have two anti-virus options: Sophos-Engine and Avira-Engine

#set security utm default-configuration anti-virus type ?

Possible completions:

 sophos-engine    Anti-virus sophos-engine

 avira-engine     Anti-virus avira-engine

 anti-virus-none    

Both Sophos and Avira are licensed separately but fall under the 'security utm' hierarchy.

More information can be found below:

Sophos - Security Sophos Anti-virus Protection Overview

Avira - Security On Device Anti-virus Scan Engine

Flow-based antivirus is a newer solution introduced in Junos release 23.4R1.. It requires a Juniper Antivirus license, "Juniper AV", and an enabled antivirus policy to function. It is a Juniper ATP Cloud feature and thus comes under the 'services' hierarchy. More information can be found here - ATP Cloud Flow Based Anti-virus Configuration Example

An easy way to identify which command applies to which antivirus type can be determined as follows:

If the command starts with "show security utm anti-virus ..." ------> It is meant to be used only with UTM anti-virus like Sophos and Avira.

If the command starts with "show services anti-virus ..." ----------->It is meant to be used only with the Flow-Based antivirus solution.

2025-03-03 : Article Created

2026-10-22 : Minor edit and visibility changed