topic Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX) in Firewall and Security Management

Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Wed, 20 Mar 2019 20:14:22 GMT

ICAP integration for R77.30 and R80.10

Configuring ICAP Server on Check Point Sandblast Appliance (TEX) or Gateway:

Enable ICAP server on TEX appliance see SK111306 and configure thread rules in Smart DashBoard.
Use hotfix 286 or higher for R77.30.

Tip!

You can use more ICAP Server in "Web Content Layer" on Bluecoat SG for example CAS appliance and TEX appliance.

Enable ICAP Server

Start ICAP server on TEX appliance or gateway:

# icap_server start

Enable ICAP Logs

# tecli advanced remote emulator logs enable <<< Hotfix 286 or higher automatically activates logging.

Enable firewall rule to connect ICAP Server (TEX Appliance)

Source: Symantec SG
Destination: "ip-address of sandblast appliance"

Port: 1344

Configure Thread Rules

Configure Thread rules in SmartDashboard

.

Configuring ICAP on Symantec SWG:

ICAP Servers Request

Go to Configuration > content Analysis > ICAP and click on New.
Enter a Name "sandblast_server" for the server.
Go to Configuration > content Analysis > ICAP and click on Edit "sandblast_server"
Enter the Service URL “icap://ip-address of sandblast appliance/sandblast”
Set the Maximum nummber of connection: 100 <<< You can configure this on sandblast appliance in config files. Set the same value. If you overstay the value you become an ICAP error!
Set Method supported: request modification <<< Use request mod.
Set Send: Client address/ Server address/ Auth user

ICAP Servers Response
1. Go to Configuration > content Analysis > ICAP and click on New.
2. Enter a Name "sandblast_server_response" for the server.
3. Go to Configuration > content Analysis > ICAP and click on Edit "sandblast_server_response"
4. Enter the Service URL “icap://ip-address of sandblast appliance/sandblast”
5. Set the Maximum nummber of connection: 100 <<< You can configure this on sandblast appliance in config files. Set the same value. If you overstay the value you become an ICAP error!
6. Set Method supported: response modification <<< Use request mod.
7. Set Send: Client address/ Server address/ Auth user
  
  ICAP Servers Response Analysis
  1. Go to Configuration > Policy > Visual Policy Manager
  2. Add Web Content Layer
  3. Enter the new > Performe Response Analysis
  4. Add Available Service:sandblast_server_response <<< Response Service
  5. Enter the new > Performe Request Analysis
  6. Add Available Service:sandblast_server <<< Request Service
  7. See Web Conten Layer Rule
  Regards,
  
  Heiko

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Alice_Shields — Mon, 26 Mar 2018 12:32:04 GMT

Nice!

Is this also possible with F5?
Do you have a documentation for F5?

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Jill_Sanders — Mon, 26 Mar 2018 12:42:38 GMT

Hi Heiko,

Do I need to add two services?
- Response Service
- Request Service

Or is it also possible to use only the "Request Service".

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 12:55:07 GMT

Comming soon!

I am currently writing a documentation for Trustwave SWG and F5 LTM. The F5 ICAP configuration is a bit more complex. Therefore, this will be a longer article. But it works without any problems. Further information can be found at F5 under the following link: Configuring Content Adaptation for HTTP Requests.

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 12:57:23 GMT

I think Response mode makes more sense, because the Sandblast Appliance can check the documents (DOC, PDF,...).

But in principle this also works.

Regards,

Heiko

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Pablo_Montega — Mon, 26 Mar 2018 18:17:10 GMT

Can you publish this for F5?

Thanks in advanced!

Pablo

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 18:29:13 GMT

I will publish this in the next days.

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Dr__Chris_Murph — Mon, 26 Mar 2018 18:46:39 GMT

Is there a documentation for other manufacturers?

E. g. Ironport, Squit, ...

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 19:07:33 GMT

I Chris, Thomas Werner from Check Point has a very nice POC implementation guide with many examples for ICAP integration.

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Ulf_Wegner — Mon, 26 Mar 2018 19:29:53 GMT

Is it possible to user more Symantec SG „Web Content Layer“ one for the CAS appliance and one for sandblast appliance?

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Mon, 26 Mar 2018 20:30:54 GMT

Yes, it is possible to use several ICAP services in one "web content layer". I think we should discuss this in a Symantec forum.

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Armin_Weiler — Tue, 27 Mar 2018 11:55:18 GMT

Is it possible to use one layer or do I need two layers "web content layer" and " web access layer"?

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

StuartGreen — Tue, 27 Mar 2018 13:55:40 GMT

I think you need two layers - the web access layer will allow your connections and the content layer is responsible for the ICAP req/resp modifications. I'm not sure if you can combine actions from access and content layers (It's been a while since I've used a Proxy SG).

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Jeroen_Vreugden — Tue, 27 Mar 2018 14:42:17 GMT

This is really great info. We also look for the same kind of solution for our McAfee customers, where for example the TIE server sends files for emulation to TEX, based on the ThreatPrevention API for example.

Did you, or anyone else try to build something like this ?

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Thomas_Werner — Tue, 27 Mar 2018 16:30:00 GMT

Hi Heiko,

this is not needed anymore:

Enable ICAP Logs

# tecli advanced remote emulator logs enable

The included ICAP server (since JHF286) will create logs automatically.

Regards Thomas

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Tue, 27 Mar 2018 16:37:43 GMT

THX Thomas

I'll change that tomorrow.

Regards,

Heiko

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Tue, 27 Mar 2018 18:49:35 GMT

Hi Jeroen,

it is possible with McAfee WebGateway.

I already installed it at a customer environment.

Maybe Thomas Werner from Check Point can send you the POC Guide. He described the integration of the McAfee SWG here.

Regards

Heiko

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

HeikoAnkenbrand — Tue, 27 Mar 2018 19:07:00 GMT

It is possible! You can combine actions from access and content layers.

> web access layer for ICAP requests

> web content layer for ICAP response

Regards

Heiko

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Thomas_Werner — Fri, 21 Jun 2019 09:22:47 GMT

So I followed Heikos initiative and posted a sample config for McAfee Web Gateway https://community.checkpoint.com/docs/DOC-2814-mcafee-web-gateway-icap-and-sandblast-appliance-tex

Regards Thomas

Re: Symantec (Bluecoat) SG ICAP and Sandblast (TEX)

Thomas_Werner — Fri, 21 Jun 2019 09:22:50 GMT

Hi Jeroen,

without deeper knowledge of the McAfee TIE Server it looks like TIE2ATD integration is proprietary, so there is no way to leverage our API here:

McAfee Support Community - How to integrate McAfee Threat Intelligence Exchan... - McAfee Support Community (check Video at 3:30)

But you can attach our Sandbox to McAfee Web Gateway and also within your mail flow via MTA. Here is the MWG ICAP config:

https://community.checkpoint.com/docs/DOC-2814-mcafee-web-gateway-icap-and-sandblast-appliance-tex

Afterwards you can share our Threat Intelligence via our McAfee DXL integration:

LEA/DXL Connector for McAfee ePO Integration

Regards Thomas