Forum Discussion
Marvin_129795
Nimbostratus
NimbostratusF5 ASM with Mcafee Virusscan for storage ICAP server
Dear all,
Working on a integration with F5 ASM with Mcafee Virusscan for storage (ICAP server) and the server keeps sending me HTTP response code 400 Bad Request. Below the configuration and Wireshark output and logs.
Following is the response code 400
In ASM request log the following is being logged
This is the ouput of that log
F5 is configured with /REQMOD as stated in the documentation
I believe we are using the right solution for ICAP scanning Mcafee Virusscan for storage with ICAP AV scanner enabled version 8.8 hotfix 4 and Enterprise for storage 1.1
MarvinCirrocumulus
Also tried to use different URL like /AVSCAN or /reqmod in small letters but all of them ends with the same error. Someone an idea why this is happening?- any logs on icap server to find out why it consider that is bad request?
Hussein_Ghazy_3Can you upload tcpdumps for icap server? In the mean time make sure that Virus-header-name under ASM advanced configuration is configured correctly. For McAfee it should look like that: X-Infection-Found,X-Virus-Name. Regards- Marvin
I uploaded the capture file [http://we.tl/ZwnlKvezL9]
- MarvinI uploaded the ICAP traffic see below
- MarvinThe complete reply of the ICAP server is ICAP/1.0 400 Bad request Date: Tue 29 Mar 2016 16:56:06 GMT Service: McAfee VirusScan Enterprise for Storage 1.1.0.127 Service-ID: VSES ISTag: "5800.7501.8114.0"
- MarvinX-Infection-Found,X-Virus-Name is already configured as the variable as default. Dont see much logs appearing in the Mcafee Virusscan
- MarvinI opened a case to F5 C2078313
Pascal_Tolenaa1I think you should use the service URI avscan instead of reqmod...
- Pascal_Tolenaa1
I think you should use the service URI avscan instead of reqmod...