Forum Discussion
NimbostratusF5 ASM and Antivirus
Hi,
I have noticed that when ASM sends files for scanning by AV, it sends the full HTTP request, (copy of what is received from the user at F5 ASM in a post format). Is there a way to send ONLY the file attachment rather than the full POST request? In this regard, does F5 follow ICAP standard fully?
Kindly advise.
Seeker
Vijith_182946Cirrostratus
Hope this link will help, i think you can do this with a custom http icap profile.
https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-3-0/12.html
Jad_Tabbara__J1Hello,
Have you associated following profiles to your VS (that applies the ASM profile) :
- A "HTTP Profile"
- A "Request Adapt Profile" // if your ICAP server need to inspect client request
- A "Response Adapte Profile" // if your ICAP server need to inspect backend servers responses
You will also need to create a second VS (type "Internal") that will load balance traffic forwarded by the first VS to your ICAP servers. For this internal VS you will need to assign an "ICAP" profile.
Following KB gives details about the implementation of ICAP
https://support.f5.com/csp/article/K15819Regards