Forum Discussion
MVPconnect to an icap server, but is it possible to route only specific services to the virtual server?
Since it's created as an internal virtual server, I don't know what traffic is going through that VS.
Is it possible to configure it so that only certain services go through that VS?
https://www.f5.com/pdf/solution-center/f5-ssl-orchestrator-and-mcafee-dlp-recommended-practices-guide.pdf
Hello,
Have you configured any service chains? This is where you would setup which services / routing would go towards that VS. Something like this:
Service Cain: chain_dlp_scan. description - "Chain for DLP-sensitive traffic".
services - Move icap_dlp (and any other services like inline L3 firewall) from Services Available to Selected Service Chain Order. Order matters (e.g., decrypt > ICAP > re-encrypt).
Then you would look at security policies -- creating a rule --
- Conditions (match-all or match-any):
- Source: IP/subnet (e.g., client from 10.0.0.0/8).
- Destination: IP/subnet, geolocation, port (e.g., dest port 80/443), or host/SNI (e.g., category "Social Networking" via URLDB).
- Protocol: HTTP, TCP, etc.
- Other: IP Intelligence (reputation), flow info.
- Examples from guides: Bypass for financial/healthcare URLs to comply with regulations (use URL Category Lookup).
- Actions:
- SSL Check: Decrypt or bypass.
- Service Chain: Assign to chain_dlp_scan (includes ICAP) for matching traffic.
- Server Certificate Check: Reject invalid certs
- Conditions (match-all or match-any):
1 Reply
- Jeffrey_Granier
Employee
Hello,
Have you configured any service chains? This is where you would setup which services / routing would go towards that VS. Something like this:
Service Cain: chain_dlp_scan. description - "Chain for DLP-sensitive traffic".
services - Move icap_dlp (and any other services like inline L3 firewall) from Services Available to Selected Service Chain Order. Order matters (e.g., decrypt > ICAP > re-encrypt).
Then you would look at security policies -- creating a rule --
- Conditions (match-all or match-any):
- Source: IP/subnet (e.g., client from 10.0.0.0/8).
- Destination: IP/subnet, geolocation, port (e.g., dest port 80/443), or host/SNI (e.g., category "Social Networking" via URLDB).
- Protocol: HTTP, TCP, etc.
- Other: IP Intelligence (reputation), flow info.
- Examples from guides: Bypass for financial/healthcare URLs to comply with regulations (use URL Category Lookup).
- Actions:
- SSL Check: Decrypt or bypass.
- Service Chain: Assign to chain_dlp_scan (includes ICAP) for matching traffic.
- Server Certificate Check: Reject invalid certs
- Conditions (match-all or match-any):
