The back-office work-order dispatch segment uses proxy-based inspection with antivirus enabled, and a field engineer downloads a firmware image far larger than the antivirus profile's configured oversize-file threshold. What is the expected behavior for that download?

Proxy-based inspection buffers a complete object before releasing it, but that buffering has a configurable size limit set by the antivirus profile's oversize-file threshold; once a file exceeds that threshold, FortiOS stops trying to scan it in full and instead applies the profile's configured oversize action, commonly either passing the file through unscanned or blocking it, depending on how the administrator balanced risk against usability for that segment. Splitting a large file into chunks for separate scanning is not how FortiGate's proxy-based antivirus operates; the engine works against the reconstructed object as a whole, not partial fragments, so there is no chunk-and-reassemble behavior. Automatically treating any oversized file as an infection would be a dangerous overreach with no basis in the antivirus architecture — size alone says nothing about content, and the feature exists specifically to give administrators an explicit choice rather than an automatic verdict. The oversize threshold is not exclusive to flow-based inspection; because proxy-based mode is the one doing the full buffering in the first place, the size ceiling matters just as much, if not more, there, and it applies to both inspection modes. To confirm the configured behavior, check the antivirus profile's oversize-file action setting and test with a file above that size limit while reviewing the antivirus log for a pass or block verdict.