For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

GGoran_276252's avatar
GGoran_276252
Icon for Nimbostratus rankNimbostratus
Jul 20, 2016

F5 with Symantec external antivirus (ICAP protocol)

Hi, first time asking a question here. We're trying to setup an F5 ASM to forward files to external antivirus for scanning (Symantec Protection Engine for Cloud Services) with ICAP protocol. There ha...
ASM Advanced WAF
BIG-IP
security
Hannes_Rapp_162's avatar
Hannes_Rapp_162
Icon for Nacreous rankNacreous
Jul 20, 2016

A simple starter: Have you checked your ASM policy blocking settings - Do you have "block" flag ticked for "Virus detected"?

 

GGoran_276252's avatar
GGoran_276252
Icon for Nimbostratus rankNimbostratus
Jul 20, 2016

Yes, ASM is in blocking mode. We tried with Transparent policy, but it didnt block files, only logged it with responce 200 (OK), so we had to change it to Blocking policy. I should add that it sucessfully removes the file from attachment, but it doesn't give user any notification of this. User only gets a message as usual "message sent", and we'd like it to give notification to user about a problem with file.