For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

M_Hallster_2314's avatar
M_Hallster_2314
Icon for Nimbostratus rankNimbostratus
Oct 28, 2015

Virus Scanning with ClamAV

I've read some really good information regarding the integration of F5 to antivirus for file scanning, but wanted to verify something before proceeding. I have a F5 Big-IP (11.6) with the ASM module ...
M_Hallster_2314's avatar
M_Hallster_2314
Icon for Nimbostratus rankNimbostratus
Oct 29, 2015

Thank you IheartF5 for the response. Now that I've done more reading, I should've said ICAP Server instead of proxy. From additional reading and looking at the diagram in the link you provided, I would need to standup an ICAP server (pretty sure ClamAV does not provide this capability). With all that said, from my understanding with Big-IP 10.6, all you have to do is configure anti-Virus Protection (under Integrated Services) and files (under 20MB) are automatically sent to the ICAP server (see inserted pic).

 

  • AP's avatar
    AP
    Icon for Nimbostratus rankNimbostratus
    Mar 03, 2016
    Hi, How did you go integrating with ClamAV? Any issues? I'm currently integrating ASM with SquidClamAV and having issues, however it seems the Squid component is really redundant since the F5 is the proxy, so I'm not sure that the 3rd party looking after SquidClamAV server has their solution configured to work as just an ICAP Server + ClamAV. Wondering if anyway has any experience or tips with SquidClamAV? Thanks
  • AP's avatar
    AP
    Icon for Nimbostratus rankNimbostratus
    Mar 08, 2016
    For anyone interested, it seems that C-ICAP Server, which is commonly used in conjuction with ClamAV and is also part of the SquidClamAV solution, does not work with file uploads as part of POST requests. In particular, we were trying to send multi-part form file uploads for scanning, but CLAMAV doesn't receive the full payload. The c-icap developer himself even mentions: "The virus_scan module can not scan uploaded data (eg those which included in a POST request). It scans only downloaded data."