Eicar is the only safe way to test AV functionality. The Eicar files are recognized by the firewall's AV, so it should be a valid test for you as long as you are scanning for the traffic (i.e., make sure you have an AV profile for the traffic type, make sure you're decrypting SSL if it's on an SSL page, etc.).
Anything else you do can potentially be dangerous to your network. If the firewall is misconfigured and you use a live malware file, you risk compromising your environment.
recognized by the Firewall = not in the signatures in last months, please see here
Does your firewall find eicar here ? https://www.etes.de/downloads/eicar-testvirus/
There was a bug in the AV signature update for Eicar a while ago, but it's working fine again now. I'm right now using AV version 1707-2185. Are your AV signatures updated?
Go to Monitor -> URL Filtering, and filter out "( referer eq 'http://www.eicar.org/85-0-Download.html' )". You could perhaps also add "and ( url eq 'www.eicar.org/download/eicar.com' )" if you clicked the first test object on Eicar.
Check the column "Rule", to see which rule it hits.
Then check the policy, and the correct Rule, to see if you have a working AV profile there. Action "allow" in the profile will most likely not log anything.
When everything is working, you should be able to click the magnifier for the selected logs in URL filtering, and in there see related logs, and there the Eicar virus.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!