For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vijay_Jain_3790's avatar
Vijay_Jain_3790
Icon for Nimbostratus rankNimbostratus
Apr 03, 2019

ASM/ICAP file upload problem

We are encountering intermittent File upload issue after TMOS 11.6.0 to 13.1.1 upgrade. We are using ICAP service for file scanning and in the ASM events logs it showing blocked “Virus detected“ and ...
ASM Advanced WAF
LTM
security
suttonsc's avatar
suttonsc
Icon for Employee rankEmployee
Apr 04, 2019

There is a timeout happening causing the response to be classified as a violation/virus.

It's difficult to know what specifically is contributing to the timeout without packet captures and debug logs. In that case I recommend opening a support case.

However, there are three control parameters for ICAP connections that can be adjusted to help:

  icap_server_max_response_time  -  default value 120s

  icap_server_max_send_time  -  default value 25s trying to send packet

  icap_server_max_connections  -  default value 10 connections

These can all be set using "/usr/share/ts/bin/add_del_internal".

Example:

/usr/share/ts/bin/add_del_internal add icap_server_max_response_time 240