Sonicwall AV Definition breaking AppAware Processing

[SBarrett847]

EDIT:- Can a MOD move this to the main B&R forum? I placed it here by mistake.

Just a heads up for other Sonicwall users that might have issues with application aware processing failing.

Sonicwall AV definition - Cloud Id: 56333863 will stop Veeam copying the Guest agent across to the VM during backup and the Job will fail. The Offending file is "VeeamVssHook_X64.dll" and it will show in the Sonicwall logs as "Gateway Anti-Virus Alert: (Cloud Id: 56333863) Agent.FL (Trojan) blocked."

Adding Cloud Id: 56333863 to the "Cloud AV DB Exclusion Settings" under the Gateway Anti-Virus Page, will have you up and running again.

I have a call open with Sonicwall, not sure how likely they are to white-list the affected file.

[kubimike]

Can't you just put that traffic across a different interface and uncheck the AV rule in trusted interfaces ? That's what I'd do. I have a lot of sonicwall a that I manage.

[SBarrett847]

Can't you just put that traffic across a different interface and uncheck the AV rule in trusted interfaces ? That's what I'd do. I have a lot of sonicwall a that I manage.

Yep I could do that , even disable the AV completely, but it doesn't seem prudent , now I know that the particular AV signature is bad

[kubimike]

It may not be prudent, but necessary to scan data going to a Veeam cloud seems like a waste of resources

[NightBird]

Or you have a lot of UTM horse power to waste