For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mike_Maher's avatar
Mike_Maher
Icon for Nimbostratus rankNimbostratus
Jan 23, 2013

ASM and ICAP File Scanning

I am looking to implement ICAP file scanning for one of my applications that run through ASM. I am curious if anyone has any experience with this, and if you could tell me if there are any performanc...
app sec
BIG-IP Access Policy Manager (APM)
security
Torti's avatar
Torti
Icon for Cirrus rankCirrus
Jan 23, 2013
Hi,

 

we are using it for file uploads. Here it seems to work fine.

 

You are running 11.x? Do you want to use it for an application or a web service?

 

There is a (in my opinion) big bug, described in SOL12984. So, the maximum file size for ASM and ICAP can be 20mb. Bigger files are not send to the ICAP-server.

 

Another Bug is 346498.

 

You need 100% reachability of your ICAP server. If it isn't reachable, the files will be blocked and you get an alert about virus detection.

 

The only performance hit I know, is the increasing memory allocation of your ASM. The complete request will be hold back until you get a response. Bigger files need more memory.

 

Thats the reason for the 20mb limit, I think. So storage isn't a problem, its the RAM. If you don't have enough memory, your ASM is running out of memory. This results in swapping or can result in big troubles :-(

 

I don't believe files are keeping in system after response. The ASM don't save files. Its like any other request. The full request will be send to the ICAP server.

 

 

regards