F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

2funky_105078's avatar
2funky_105078
Icon for Cirrus rankCirrus
Oct 10, 2017

Multiple ICAP servers with ASM

Hello,   Is it possible to send files to be analyzed to multiple ICAP servers? Normally documentation/ASM GUI mentions only 1 server host: https://support.f5.com/csp/article/K70941653   Can we ...
ASM Advanced WAF
icap
security
Daniel_Varela's avatar
Daniel_Varela
Icon for Employee rankEmployee
Oct 10, 2017

You should be able to refer a VIP as far as everything is in route domain 0 (you may make this work in other route domains if strict isolation is disabled). In your VIP configuration then set a pool of ICAP servers and look after persistence. This should work fine.

 

Regarding ASM triggering the violation, yes it does and it provides some details about the malware/thread detected. You need to go to advanced settings in ASM en set the specific ICAP header that your ICAP server uses to provide this information. Then you should see nice alarm violations in your event log (this is always subject to your block setting configuration)

 

When to use ASM and LTM, well I'd say LTM is more flexible and it works better overall but it lacks integration with ASM. ICAP on ASM got some limitations, for example the longest request length supported by the system by default is 10MB and you can go to 30MB without big issues. If you expect to deal with big files this may be a problem. Going beyond that requires to involve F5 support.