Forum Discussion

GGoran_276252's avatar
GGoran_276252
Icon for Nimbostratus rankNimbostratus
Jul 20, 2016

F5 with Symantec external antivirus (ICAP protocol)

Hi, first time asking a question here. We're trying to setup an F5 ASM to forward files to external antivirus for scanning (Symantec Protection Engine for Cloud Services) with ICAP protocol. There ha...
ASM Advanced WAF
BIG-IP
security
Vijith_182946's avatar
Vijith_182946
Icon for Cirrostratus rankCirrostratus
Jul 23, 2016

This might help : https://support.f5.com/kb/en-us/products/big-ip_asm/manuals/product/asm-implementations-11-5-0/37.html

 

boneyard's avatar
boneyard
Icon for MVP rankMVP
Jul 23, 2016

in principle this should just work, if an ASM policy is violated then that page is shown if you didn't make any extreme changes. do you get the blocking page when you violate something else?

your whole policy might be in blocking but what about the specific "Virus detected" setting?

this is set in Blocking section upto 11.6 and (which took me some time to find) from 12.0 here:

Security  ››  Application Security : Policy Building : Learning and Blocking Settings