topic Re: ICAP client on R80.20 and 3rd DLP Server Symantec in Firewall and Security Management

ICAP client on R80.20 and 3rd DLP Server Symantec

Alessandro_Marr — Tue, 26 Mar 2019 21:23:57 GMT

Hello all, anyone could share a configuration example about using R80.20 as a client ICAP for a Web Prevent Symantec DLP Server?

when I Trying the gateway doesn´t understand a message to block came from DLP server.

Thanks.

Regards.

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

PhoneBoy — Thu, 28 Mar 2019 00:58:17 GMT

I believe our initial support around ICAP was developed specifically for Symantec DLP.
It would help to understand what steps you've taken to configure it.

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

Alessandro_Marr — Wed, 03 Apr 2019 10:49:05 GMT

Hello Dameon, do you have a configuration (example) to share? I have a DLP server Symantec WEB Prevent version 15.x, SMS R80.20 M2 and two gateways r80.20 take 33 using Cluster high availability,

When my DLP server respond an ICAP request message from my gateway (in REQMOD) the body message came with a html format explain the block ocurred and my gateway does not show the page. I tried change the parameter to show block message or not show block message... but didn´t work.

**parameter user_check_interaction_name is correct.

# vi icap_client_blade_configuration.C

(
:enabled ("true")
:filter_http_method (
: (
:method ("POST")
)
)
:http_services (
: (
😛ort (8080)
)
)
:inspect_html_response ("true")
:user_check_interaction_name ("Bloqueio de Aplicativo")
:trickling_mode (0)
:log_level (1)
:icap_servers (
: (
:name ("DLP_Symantec")
:ip ("10.100.1.190")
:ip6 ("")
😛ort (1344)
:service ("reqmod")
😛roto ("icap")
:modification_mode ("reqmod")
:transp ("3rd_cpas")
:failmode (open)
:timeout (61)
:max_conns (100)
:user_check_action (2)
:x_headers (
:x_client_ip ("true")
:x_server_ip ("true")
:x_authenticated_user ("true")
:authentication_source ("Local")
😛ase64_username_encode ("true")
)
)
)
:rules_type ("include")
:network_filter_rules_ip4 (
: (
:src_ip_ranges (
: (
:min_ip ("10.100.41.105")
:max_ip ("10.100.41.106")
)
)
:dst_ip_ranges (
: (
:min_ip ("any")
:max_ip ("any")
)
)
)
)
:network_filter_rules_ip6 (
: (
:src_ip_ranges (
: (
:min_ip ("")
:max_ip ("")
)
)
:dst_ip_ranges (
: (
:min_ip ("")
:max_ip ("")
)
)
)
)
)

Thanks

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

PhoneBoy — Wed, 03 Apr 2019 17:13:13 GMT

I don't have sample configurations, I just know from prior conversations with R&D where previous versions of this feature came from 🙂
I recommend engaging with the TAC on this as I do see a couple support tickets on this (but on earlier releases).

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

Alessandro_Marr — Fri, 05 Apr 2019 13:40:23 GMT

ok, thank you.

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

HeikoAnkenbrand — Fri, 05 Apr 2019 20:45:30 GMT

Hi @Alessandro_Marr

ask @Thomas Werner

He is an expert in TE and ICAP questions.

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

HeikoAnkenbrand — Fri, 05 Apr 2019 20:47:31 GMT

Or see SK111305:

Check Point support for Internet Content Adaptation Protocol (ICAP) client with data modification

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

Aleksandr88 — Mon, 22 Jul 2019 14:54:55 GMT

did u succeed in setting up successfully?

Re: ICAP client on R80.20 and 3rd DLP Server Symantec

Alessandro_Marr — Fri, 30 Aug 2019 12:39:28 GMT

yes, using r80.20 take 74