For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

seilemor_131269's avatar
seilemor_131269
Icon for Altostratus rankAltostratus
12 years ago

ICAP integration will not work

Hello community,   I want to check with the ASM module uploaded files against an ICAP server (Bluecoat Proxy AV). I´ve configured the ICAP settings and the settings in the asm policy. If I now upl...
design
icap
management
security
Philipp_Stadler's avatar
Philipp_Stadler
Icon for Nimbostratus rankNimbostratus
12 years ago

Hi,

 

I've similar problems for the file scanning - I configured the settings as you described (virus_header_name and other av settings in ASM).

 

When I do a tcpdump I can see:

 

  1. REQMOD icap://1.2.3.4:1344/reqmod ICAP/1.0\r\n
  2. no ICAP answer from server
  3. multiple "Continuation" from F5
  4. nothing else

I've also tested the request adaption method, but I don't want to send every request to the ICAP server (only file uploads). With request adaption I got:

 

  1. REQMOD icap://1.2.3.4:1344/avscan ICAP/1.0\r\n

     

    (avscan is the service name on Bluecoat AV)

     

  2. ICAP/1.0 200 OK\r\n

     

  3. multiple "Continuation" from F5 with TCP-ACKs from Bluecoat

     

  4. nothing else

This seems better to me, because Bluecoat answers with ICAP OK.

 

So I have some questions:

 

Is there any log or anything else for better troubleshooting this issue?

 

Can I adjust the "servicename" in ASM config method?

 

Does anyone have an idea, what may be the problem?

 

Thanks for your response, Philipp