Forum Discussion

nathe's avatar
nathe
Icon for Cirrocumulus rankCirrocumulus
Aug 23, 2010

ASM, ICAP and v10.2

Hi All, I posted this into a reply to an existing forum topic as I was after the same info. It was in the iRules forum so thought I'd pop what I'd found into this forum so more peeps will be aware. Hope it's useful. Just seen this in "BIG-IP Application Security Manager version 10.2.0 Release notes", under "New Features": ****** Anti-virus scanning: With this version you can configure the Application Security Manager to act as an Internet Content Adaptation Protocol (ICAP) client. The system asks an external ICAP server to check HTTP file uploads for viruses before releasing the content to the web-server. To configure antivirus protection, from the Configuration utility, navigate to Application Security » Options » Anti-Virus Protection. If the system detects a virus in an incoming request, the system issues the violation Virus Detected, and logs or blocks the illegal request, depending on how you have configured the settings of this violation on the Policy Blocking Settings screen. We added an advanced configuration parameter, Virus header name, which is the name of the response header that the ICAP server returns when it detects a virus. The parameter’s default value is X-Virus-Name, which is McAfee’s default response header. If you are using a different ICAP server, change this parameter’s value to the appropriate value used by that ICAP server. This parameter is found on the Advanced Configuration screen (from the Configuration utility, navigate to Application Security » Options » Advanced Configuration) ***** Rgds N
  • Hi Nathan,

     

     

    I'm working with this same configuration except version 11.2.1. The ICAP is configured to add a HTTP header on the response back from ICAP.

     

    But after the client who was uploaded the file infected is redirect to JBOSS server and the header name is not present.

     

     

    Do you think I can add a header name on the client --> JBOSS connection if there is a header in a ICAP back ?

     

     

    Thanks for your help.

     

    Bertrand