7.3. Web Anti-Virus

Web Anti-Virus is a service that detects and blocks viruses that invade via Web access (HTTP communication) and FTP communication.


  • Web Anti-Virus is used via Service Interconnectivity. You need to apply separately for Service Interconnectivity.

7.3.1. Available Features

You can use the following features in Web Anti-Virus.
Feature Overview
Virus scan A feature that monitors Web access (HTTP communication) and FTP communication, and executes specified processes when viruses are detected.

7.3.2. Virus Scan Feature

HTTP and FTP are the protocols targeted for inspection by Web Anti-Virus.
You can choose the detection and blocking operations for each protocol. The detection and blocking processes are shown below.
Item Process Information Recorded in Logs
Allow Allows communication. None
Monitors Web access (HTTP communication) and FTP communication, and detects viruses.
However, traffic is not blocked even though viruses are detected.
Detection Status
Monitors Web access (HTTP communication) and FTP communication, and detects viruses.
Note that communication is blocked when viruses are detected, and a blocked screen is displayed to the user.
Blocking status


  • If NTT Communications judges it necessary, we will notify you via email, etc. of the detection and blocking status (for blocking only).
Routing Settings
Only communication via Web Anti-Virus is targeted for detection. When you use Web Anti-Virus, please set the following routing.
  • The communication addressed to Server Segments targeted for protection is set so that it is routed by vFirewall/Integrated Network Appliance to the Service Interconnect Gateway used for Web Anti-Virus.
  • The communication from the Virtual Machine is set so that it is routed by the Virtual Machine on the Server Segment targeted for protection to the Service Interconnect Gateway used for Web Anti-Virus.
  • If you perform Ping monitoring on the Virtual Machine, you will require an additional Server Segment for direct connection between vFirewall/Integrated Network Appliance and the Virtual Machine.


  • Please do not connect the Server Segments targeted for detection directly to vFirewall/Integrated Network Appliance.
Analysis Capacity
The traffic volume that can be analyzed by Web Anti-Virus is shown below.
Item Performance Remarks
Per service Maximum(5 services used)
Traffic Processing Capacity 200 Mbps 1 Gbps The total value of uplink and downlink.
Number of concurrent sessions 40,000 200,000 The number of sessions that can be connected simultaneously.


  • You can increase the traffic volume up to 1 Gbps, 200,000 sessions (when 5 services used) by applying additional services. When using more than 2 of service, please contact each NTT Communications affiliate beforehand.

7.3.3. Important Points

Used IP Addresses
  • In order to connect the Service Interconnect Gateway with Web Anti-Virus, you must have two IP address blocks available. If the IP address block is already being used, we might ask you to change it.
  • NTT Communications will manage the assigned IP address blocks, and assign IP addresses to the devices that require them.
  • When the actual traffic volume exceeds the contracted traffic volume, the excess traffic might be discarded.
  • The following communication and files are not targeted for detection and blocking.
    • Encrypted communication (that used HTTPS or SFTP, etc.)
    • Files set with passwords
    • Files compressed by compression algorithms other than zip/gzip
    • Files compressed by compression algorithm zip/gzip three times or more
  • Packets which break TCP/UDP/IP protocol rules or abnormal packets are discarded as a standard function regardless of customer’s configuration.


    • When the IP header is cut off in the middle
    • When the Port number is 0 (zero)
    • When the TCP flag combination is abnormal and others
  • If devices making up this feature are replaced due to malfunction etc., you will not be able to check device logs or event reports from prior to the replacement via the Security Web Portal. In addition, if the regular server and the standby server are switched for a redundantly configured device and they are restored without replacing the device, you cannot check the log or the event reports for the period during which the switching occurred from the Security Web Portal.

  • Web Anti-Virus does not guarantee that the Web Anti-Virus feature has integrity or accuracy, or is suitable for your use. Furthermore, the suitability of the virus identification algorithms provided by the developers or distributors of the devices making up the Web Anti-Virus feature is not guaranteed.

  • The following information might be provided to the developers or distributors of the devices making up the Web Anti-Virus feature.

    • Configuration information obtained from providing Web Anti-Virus
    • Information concerning detection etc., for Web Anti-Virus
  • We cannot guarantee recovery from failures that might occur due to incompatibility between Web Anti-Virus and your environment, or failures that occur due to your operations other than those specified by NTT Communications.

  • There may be times when the customer’s environment is affected by maintenance services. An advance notice will be sent when there are possible effects to the customer’s environment. This is not applied when we judge the maintenance work urgent to continue service.