For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

arpydays_190826's avatar
arpydays_190826
Icon for Nimbostratus rankNimbostratus
Jul 06, 2015

LTM ICAP via Internal VS and possible ASM integration

Hi,   I've been told by F5 FSE that if we do ICAP via LTM and internal VS instead of ASM for AV Scanning of uploads (to get round buffer size limitation) we can use new rule events in v11.5 to rai...
application delivery
deployment
design
devops
iRules
LTM
security
arpydays's avatar
arpydays
Icon for Nimbostratus rankNimbostratus
Jul 15, 2015

Hi Michael,

 

In my testing the ADAPT::result value is either "respond" indicating that a block page response has been returned from the ICAP server or "modify" meaning that there may no violation and the ICAP server is simply returning the full request to the ICAP client - this may need consideration in the logic. I've not come across any use-cases for "bypass" with our implementation, I think this may only apply "204 No modification needed" but this is not offered as a supported option by the F5 ICAP client and I have preview turned off (due to some other issues noted while testing)

 

cheers