topic Re: Fortigate Firewall ICAP and Sandblast (TEX) in Firewall and Security Management

Fortigate Firewall ICAP and Sandblast (TEX)

HeikoAnkenbrand — Wed, 20 Mar 2019 20:13:45 GMT

ICAP integration for R77.30 and R80.10

Configuring ICAP Server on Check Point Sandblast Appliance (TEX) or Gateway:

Enable ICAP-Server on TEX Appliance see SK111306 and configure Thread rules in DashBoard.
Use Hotfix 286 or higher for R77.30.

Enable ICAP Server

Start ICAP server on TEX appliance or gateway:

# icap_server start

Enable ICAP Logs

# tecli advanced remote emulator logs enable <<< Hotfix 286 or higher automatically activates logging.

Enable firewall rule to connect ICAP Server (TEX Appliance)

Source: Fortigate
Destination: "ip-address of sandblast appliance"

Port: 1344

Configure Thread Rules

Configure Thread rules in SmartDashboard

.

Configuring ICAP on Fortigate:

ICAP Servers

Go to Security Profiles > ICAP Servers and click on Create New.
Enter a Name "sandblast_server" for the server.
Enter the server's IP Address “ip-address of sandblast appliance”
Set the Port; 1344 is default TCP port used for the ICAP traffic.

Maximum Connections

config icap server

edit sandblast_server

set max-connection 100 <<< You can configure this on sandblast appliance in config files. Set the same value. If you overstay the value you become an ICAP error!

end

Profile

Go to Security Profiles > ICAP and click on Create New.
Enter a Name "Sandblast_Profile" for the server.
Enable settings as required.
1. Enable Request Processing allows the ICAP server to process request messages. If enabled this setting will also require:
2. Enable Response Processing allows the ICAP server to process response messages. If enabled this setting will also require:
3. Enable Streaming Media Bypass allows streaming media to ignore offloading to the ICAP server.
Select Apply.

Enable firewall rule to connect ICAP Server (TEX Appliance)

Source: Fortigate
Destination: "ip-address of sandblast appliance"

Port: 1344

Enable firewall rule to use ICAP Profile

Source: xyz-ip
Destination: xyz-ip

Port: http

Profile: "Sandblast_Profile"

---

Better:

Use a Check Point Firewall!

Regards,

Heiko

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Jejj_Longman — Mon, 26 Mar 2018 18:02:31 GMT

With which Fortigate version does this work?

Re: Fortigate Firewall ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 18:30:28 GMT

I had checked this with FortiOS 5.4 and 5.6

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Thomas_Werner — Tue, 27 Mar 2018 16:28:14 GMT

Hi Heiko,

this is not needed anymore:

Enable ICAP Logs

# tecli advanced remote emulator logs enable

The included ICAP server (since JHF286) will create logs automatically.

I also assume the caption should read "Fortigate" 🙂

Regards Thomas

Re: Fortigate Firewall ICAP and Sandblast (TEX)

HeikoAnkenbrand — Tue, 27 Mar 2018 16:39:20 GMT

THX Thomas

I'll change that tomorrow.

Regards,

Heiko

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Pablo_Montega — Thu, 29 Mar 2018 09:15:14 GMT

Is it possible to use ICAP with other firewall?

Anybody got experience?

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Thomas_Werner — Thu, 29 Mar 2018 09:43:31 GMT

Hi Pablo,

what do you exactly mean ?

Attaching a FW with ICAP client functionality to the SandBlast ICAP server ?

Actually you can attach any RFE ICAP client to our solution ...

Regards Thomas

Re: Fortigate Firewall ICAP and Sandblast (TEX)

S__B_ — Mon, 02 Apr 2018 07:10:36 GMT

Is it possible to use the FortiProxy on Fortigate with ICAP?

Re: Fortigate Firewall ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 02 Apr 2018 09:14:43 GMT

Yes, it is possible for the proxy function in the fortigate firewall.

Regards,

Heiko

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Slavisa_Stojkov — Sun, 13 May 2018 11:29:37 GMT

Forti OS 5.4.7 doesn‘t work as proxy. I become an icap error: To many icap connections.

Re: Fortigate Firewall ICAP and Sandblast (TEX)

HeikoAnkenbrand — Fri, 25 May 2018 12:40:00 GMT

Hello Slavisa,

FortiOS 5.4.7 is very buggy. I would use the 5.4.8 version. But we should not discuss in Check Point forum.

Regards,

Heiko

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Oleksandr_Rapp — Tue, 26 Feb 2019 14:22:43 GMT

Maximum Connections

config icap server

edit sandblast_server

set max-connection 100 <<< You can configure this on sandblast appliance in config files. Set the same value. If you overstay the value you become an ICAP error!

end

Which config files on sandblast appliance should i configure?

Re: Fortigate Firewall ICAP and Sandblast (TEX)

Tsvika_Skupinsk — Wed, 27 Feb 2019 10:22:47 GMT

All, please be noted that the R77.30 RFE is not relevant anymore on MT with GUI (R80.20 GA or R80.10 JHF>167)

See Admin Guide (ICAP Server): https://sc1.checkpoint.com/documents/R80.20_GA/WebAdminGuides/EN/CP_R80.20_ThreatPrevention_AdminGuide/html_frameset.htm

Relevant sk’s are: sk123412 (ICAP Server support for Threat Prevention) & sk122853 (R80.20 Management Threat Prevention new features supported with R80.10 Jumbo Hotfix)

Re: Fortigate Firewall ICAP and Sandblast (TEX)

ruggy — Sun, 21 Jun 2020 09:30:59 GMT

Nice solution!