Forum Discussion

Vijay_Jain_3790's avatar
Vijay_Jain_3790
Icon for Nimbostratus rankNimbostratus
Apr 03, 2019

ASM/ICAP file upload problem

We are encountering intermittent File upload issue after TMOS 11.6.0 to 13.1.1 upgrade. We are using ICAP service for file scanning and in the ASM events logs it showing blocked “Virus detected“ and those are legitimate PDF files. When I checked the logs for BD file I am seeing below error message. Cross checked the ICAP server and they are not utilized at all and all the process are running fine. Does anyone face this issue.

 

ICAP|NOTICE||15259|icap_client.c:1768|Virus check: TMO waiting for icap server response job 0x2b450dc67d96 support id 13793361095438515057

 

ASM Advanced WAF
LTM
security
  • suttonsc's avatar
    suttonsc
    Icon for Employee rankEmployee
    Apr 04, 2019

    There is a timeout happening causing the response to be classified as a violation/virus.

    It's difficult to know what specifically is contributing to the timeout without packet captures and debug logs. In that case I recommend opening a support case.

    However, there are three control parameters for ICAP connections that can be adjusted to help:

      icap_server_max_response_time  -  default value 120s

  icap_server_max_send_time  -  default value 25s trying to send packet

  icap_server_max_connections  -  default value 10 connections

    These can all be set using "/usr/share/ts/bin/add_del_internal".

    Example:

    /usr/share/ts/bin/add_del_internal add icap_server_max_response_time 240