Forum Discussion

Marvin_129795's avatar
Marvin_129795
Icon for Nimbostratus rankNimbostratus
Mar 28, 2016

F5 ASM with Mcafee Virusscan for storage ICAP server

Dear all,

 

Working on a integration with F5 ASM with Mcafee Virusscan for storage (ICAP server) and the server keeps sending me HTTP response code 400 Bad Request. Below the configuration and Wireshark output and logs.

 

 

Following is the response code 400

 

 

In ASM request log the following is being logged

 

 

This is the ouput of that log

 

 

 

F5 is configured with /REQMOD as stated in the documentation

 

 

I believe we are using the right solution for ICAP scanning Mcafee Virusscan for storage with ICAP AV scanner enabled version 8.8 hotfix 4 and Enterprise for storage 1.1

 

 

application delivery
ASM Advanced WAF
icap
mcafee
security
virusscan
  • sghanem's avatar
    sghanem
    Icon for Nimbostratus rankNimbostratus
    Nov 20, 2017

    Hello Everyone,

     

    Could you please update if the integration between "McAfee VirusScan Enterprise for Storage" and F5 ASM is now working.

     

    Thank you in advance. Serge

     

  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Apr 14, 2016

    F5 has opened a feature request for the integration of F5 ASM with McAfee Virusscan 8.8, currently not supported at this moment

     

  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Apr 14, 2016
    F5 has opened a feature request for the integration of F5 ASM with McAfee Virusscan 8.8, currently not supported at this moment. The proper request is /reqmod and not /avscan.
  • Philipp_Stadler's avatar
    Philipp_Stadler
    Icon for Nimbostratus rankNimbostratus
    Apr 07, 2016

    Hi Marvin,

     

    do you have any working connection to the ICAP server (i.e. from any storage system) - so you could get a tcpdump of a working solution and compare it.

     

    regards, Philipp

     

    P.S.: I've never used the McAfee for storage.

     

  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Mar 29, 2016
    X-Infection-Found,X-Virus-Name is already configured as the variable as default. Dont see much logs appearing in the Mcafee Virusscan
  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Mar 29, 2016
    The complete reply of the ICAP server is ICAP/1.0 400 Bad request Date: Tue 29 Mar 2016 16:56:06 GMT Service: McAfee VirusScan Enterprise for Storage 1.1.0.127 Service-ID: VSES ISTag: "5800.7501.8114.0"