For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

M_Hallster_2314's avatar
M_Hallster_2314
Icon for Nimbostratus rankNimbostratus
Oct 28, 2015

Virus Scanning with ClamAV

I've read some really good information regarding the integration of F5 to antivirus for file scanning, but wanted to verify something before proceeding. I have a F5 Big-IP (11.6) with the ASM module ...
M_Hallster_2314's avatar
M_Hallster_2314
Icon for Nimbostratus rankNimbostratus
Oct 29, 2015

Thank you IheartF5 for the response. Now that I've done more reading, I should've said ICAP Server instead of proxy. From additional reading and looking at the diagram in the link you provided, I would need to standup an ICAP server (pretty sure ClamAV does not provide this capability). With all that said, from my understanding with Big-IP 10.6, all you have to do is configure anti-Virus Protection (under Integrated Services) and files (under 20MB) are automatically sent to the ICAP server (see inserted pic).

 

AP's avatar
AP
Icon for Nimbostratus rankNimbostratus
Mar 08, 2016
For anyone interested, it seems that C-ICAP Server, which is commonly used in conjuction with ClamAV and is also part of the SquidClamAV solution, does not work with file uploads as part of POST requests. In particular, we were trying to send multi-part form file uploads for scanning, but CLAMAV doesn't receive the full payload. The c-icap developer himself even mentions: "The virus_scan module can not scan uploaded data (eg those which included in a POST request). It scans only downloaded data."