topic Re: ICAP Server on Sandblast Appliance (TEX) in Firewall and Security Management

ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Wed, 28 Mar 2018 15:21:34 GMT

ICAP Server

The official ICAP Server SK mentions requirements, release notes and general information regarding the new ICAP server functionality.

Check Point support for Internet Content Adaptation Protocol (ICAP) server

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111306

ICAP Server is included since JHF 272.

Start: # icap_server start

Stop: # icap_server stop

Reconfiguration: # icap_server reconf

Note:

ICAP does not choose emulation images based on any of your TP profiles; so there is no need to configure a TP policy for ICAP but you need one to get emulation images on your SandBlast appliance
- GUI configuration will be added to R80.20 (currently in controlled EA)
Choosing to emulate on all images will result in an attempt to emulate the files on all known images, even if some of them aren’t available.
“Recommended Images” means two images (Win7/Office2013, WinXP/Office2003-7)

Configuration

Configuration files

Filename	Location	Purpose
c-icap.conf	$FWDIR/c-icap/etc/	ICAP Server process configuration file e.g. for changing ICAP server port
c-icap.magic	$FWDIR/c-icap/etc/	Filetypes supported by ICAP
virus_scan.conf	$FWDIR/c-icap/etc/	e.g. for adding filetypes from c-icap.magic, maximum file size
libsb_mod.conf	$FWDIR/c-icap/etc/	e.g. for adding filetypes from c-icap.magic
Tpapi.py	$FWDIR/c-icap/scripts/	Script used to send ICAP received files to TE API
Block message	$FWDIR/c-icap/share/c_icap/templates/virus_scan/en -rwxr-x--- 1 admin bin 392 Mar 30 09:02 VIRUS_FOUND	Block messages displayed when malware is found. If you change them don´t forget to run ICAP daemon reconf command VIRUS_FOUND is used as template for a block message; this message can be localized

Configure emulation images

All or recommended images

Choose emulation on all images or only on recommended images:

Open for editing: $FWDIR/c-icap/etc/libsb_mod.conf
Change the field sb_mod.AllImages to off (for recommended) or on (for all)

Configure specific emulation images

Not officially supported but there is a way of selecting only specific images to emulate on:

Edit $FWDIR/c-icap/etc/libsb_mod.conf
Change the field AllImages to on
Edit $FWDIR/c-icap/scripts/TPAPI.py

Add "#" in front of images you do not want to emulate on:

image_to_name = {

# 'e50e99f3-5963-4573-af9e-e3f4750b55e2': 'WinXP,Office 2003/7,Adobe 9',

'7e6fe36e-889e-4c25-8704-56378f0830df': 'Win7,Office 2003/7,Adobe 9',

'8d188031-1010-4466-828b-0cd13d4303ff': 'Win7,Office 2010,Adobe 9.4',

'5e5de275-a103-4f67-b55b-47532918fa59': 'Win7,Office 2013,Adobe 11',

# '3ff3ddae-e7fd-4969-818c-d5f1a2be336d': 'Win7 64b,Office 2013,Adobe 11',

# '6c453c9b-20f7-471a-956c-3198a868dc92': 'Win8.1 64b,Office 2013,Adobe 11',

}

te_images = [

# {'id': 'e50e99f3-5963-4573-af9e-e3f4750b55e2', 'revision': 1},

{'id': '7e6fe36e-889e-4c25-8704-56378f0830df', 'revision': 1},

{'id': '8d188031-1010-4466-828b-0cd13d4303ff', 'revision': 1},

{'id': '5e5de275-a103-4f67-b55b-47532918fa59', 'revision': 1},

# {'id': '3ff3ddae-e7fd-4969-818c-d5f1a2be336d', 'revision': 1},

# {'id': '6c453c9b-20f7-471a-956c-3198a868dc92', 'revision': 1},

]

Adding Windows 10 image for ICAP emulation

Even though you activate the Win10 image in the GUI it will not be used by the ICAP emulation because the images for image are solely selected based on a configuration file. To add the Win10 image follow this procedure:

Edit $FWDIR/c-icap/etc/libsb_mod.conf
Change the field AllImages to on

Edit $FWDIR/c-icap/scripts/TPAPI.py and add the following yellow lines:

image_to_name = {

'e50e99f3-5963-4573-af9e-e3f4750b55e2': 'WinXP,Office 2003/7,Adobe 9',

'7e6fe36e-889e-4c25-8704-56378f0830df': 'Win7,Office 2003/7,Adobe 9',

'8d188031-1010-4466-828b-0cd13d4303ff': 'Win7,Office 2010,Adobe 9.4',

'5e5de275-a103-4f67-b55b-47532918fa59': 'Win7,Office 2013,Adobe 11',

'3ff3ddae-e7fd-4969-818c-d5f1a2be336d': 'Win7 64b,Office 2013,Adobe 11',

'6c453c9b-20f7-471a-956c-3198a868dc92': 'Win8.1 64b,Office 2013,Adobe 11',

'10B4A9C6-E414-425C-AE8B-FE4DD7B25244': 'Win10 64b,Office 2016, Adobe DC'

}

te_images = [

{'id': 'e50e99f3-5963-4573-af9e-e3f4750b55e2', 'revision': 1},

{'id': '7e6fe36e-889e-4c25-8704-56378f0830df', 'revision': 1},

{'id': '8d188031-1010-4466-828b-0cd13d4303ff', 'revision': 1},

{'id': '5e5de275-a103-4f67-b55b-47532918fa59', 'revision': 1},

{'id': '3ff3ddae-e7fd-4969-818c-d5f1a2be336d', 'revision': 1},

{'id': '6c453c9b-20f7-471a-956c-3198a868dc92', 'revision': 1},

{'id': '10B4A9C6-E414-425C-AE8B-FE4DD7B25244', 'revision': 1}

]

Attaching an ICAP Client

Configure the ICAP client to communicate with the ICAP server’s “sandblast” service.

For example: icap://<ip address>:1344/sandblast

Logging

General logging

Logging (besides benign/malicious findings) is currently limited to the following log files – so no ICAP daemon logs in the GUI/SmartLog:

$FWDIR/log/c-icap/server.log

$FWDIR/log/c-icap/access.log

To extend the by default limited access log follow these steps:

vi /opt/CPsuite-R77/fw1/c-icap/etc/c-icap.conf
Search for “AccessLog /opt/CPsuite-R77/fw1/log/c-icap/access.log”
Add this line before the above finding:
- LogFormat accessFormat "%tl, %la %a %im %iu %is %huo '%<ho' '%{X-Infection-Found}<ih'"
Change the AccessLog line to:
- AccessLog /opt/CPsuite-R77/fw1/log/c-icap/access.log accessFormat

So the section in c-icap.conf should now look like this:

LogFormat accessFormat "%tl, %la %a %im %iu %is %huo '%<ho' '%{X-Infection-Found}<ih'"

AccessLog /opt/CPsuite-R77/fw1/log/c-icap/access.log accessFormat

Enable logging of benign files

Enable/Disable logs on benign files:

Open for editing: $FWDIR/c-icap/etc/libsb_mod.conf
Change the field sb_mod.LogBenign to on

Debug logging

To enable debug logging:

Open for editing: $FWDIR/c-icap/etc/c-icap.conf
- Change DebugLevel value to: 7
Restart the c-icap service.

Note ! Enabling debug logs can affect performance.

ICAP daemon troubleshooting

Start manually and get errors on startup

To get ICAP server daemon error messages on the terminal when starting launch daemon with:

# $FWDIR/c-icap/bin/c-icap -N -D -d 10 -f $FWDIR/c-icap/etc/c-icap.conf

Verify ICAP daemon is running

[Expert@sandblast]# netstat -na | grep 1344

Result should show:

tcp 0 0 0.0.0.0:1344 0.0.0.0:* LISTEN

[Expert@sandblast]# ps ax | grep c-icap

Result should show:

16443 ? Ss 0:00 c-icap -N -f /opt/CPsuite-R77/fw1/c-icap/etc/c-icap.conf

16448 ? Sl 0:00 c-icap -N -f /opt/CPsuite-R77/fw1/c-icap/etc/c-icap.conf

16453 ? Sl 0:00 c-icap -N -f /opt/CPsuite-R77/fw1/c-icap/etc/c-icap.conf

16460 ? Sl 0:00 c-icap -N -f /opt/CPsuite-R77/fw1/c-icap/etc/c-icap.conf

19319 pts/2 S+ 0:00 grep c-icap

ICAP Server response codes

{100, "Continue"}, /*Continue after ICAP Preview */

{200, "OK"},

{204, "Unmodified"}, /*No modifications needed */

{206, "Partial Content"}, /*Partial content modification*/

{400, "Bad request"}, /*Bad request */

{403, "Forbidden"},

{404, "Service not found"}, /*ICAP Service not found */

{405, "Not allowed"}, /*Method not allowed for service (e.g., RESPMOD requested

For service that supports only REQMOD). */

{408, "Request timeout"}, /*Request timeout. ICAP server gave up waiting for a

Request from an ICAP client */

{500, "Server error"}, /*Server error. Error on the ICAP server, such as "out of

disk

ICAP Performance statistics

Something I found on the web regarding c-icap performance statistics - did not have time to verify it by now but maybe someone can do and give feedback:

https://wiki.squid-cache.org/ConfigExamples/ContentAdaptation/C-ICAP#Performance_and_tuning

Re: ICAP Server on Sandblast Appliance (TEX)

Rolf_Kaschek — Fri, 30 Mar 2018 10:16:13 GMT

helpful, thx

Re: ICAP Server on Sandblast Appliance (TEX)

Hanko_Alderson — Sat, 07 Apr 2018 05:06:23 GMT

nice!

Re: ICAP Server on Sandblast Appliance (TEX)

Martinus_Kurnia — Thu, 26 Apr 2018 16:00:20 GMT

Hi werner,

Nice artikel, use full. As on above picture it seen we can configure icap server fail mode to fail-open or fail-close. It is possible to do same fail mode configuration on R77.30? I think i need to do that.

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Thu, 26 Apr 2018 16:26:43 GMT

Hi Martinus,

in most cases ICAP failopen is controlled by the Proxy (ICAP client) anyway. So the proxy decided when to fail-open/fail-close.

If you use a Check Point Gateway to gather fails for emulation there is also a fail-open/fail-close engine mode available:

In R77.30 SmartDashboard -> Threat Prevention -> Advanced -> Engine Settings -> Fail Mode

In R80 Console -> Manage & Settings -> Blades -> Threat Prevention -> Advanced Settings -> General -> Fail Mode

On the gateway side this fail mode is a general setting for all Threat Prevention blades (except IPS).

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Sergej_Dmitrije — Wed, 23 May 2018 15:27:08 GMT

Nice docu!

Re: ICAP Server on Sandblast Appliance (TEX)

Robert_Mueller — Fri, 01 Jun 2018 11:04:33 GMT

Great manual.. but when I include the Win10 Image - I get an "ERROR" in the tecli s e e command on that image..

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Tue, 05 Jun 2018 10:07:20 GMT

Hi Robert,

can you post a screenshot ?

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Robert_Mueller — Wed, 06 Jun 2018 13:33:49 GMT

Hi,

The IDs from the downloaded image is correct and the image is "ready"

Here is the screenshot of the tecli s e e command:

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Tue, 26 Jun 2018 11:35:52 GMT

Hi Robert,

sorry for the late reply. I can´t see an error related to the Win 10 image in your screenshot.

Can you post the relevant extract from $FWIDR/log/ted.elg from an affected emulation ?

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Robert_Mueller — Wed, 27 Jun 2018 07:51:17 GMT

Hi,

[ 29357 4079208192][27 Jun 9:42:52] [TE_TRACE]: Image '10B4A9C6-E414-425C-AE8B-FE4DD7B25244' is currently being downloaded, cannot emulate file
[ 29357 4079208192][27 Jun 9:42:52] [TE_TRACE]: {C2C64A44-821B-7143-A0E1-060D7C4DD924} verdict 'Error' set for image: '10B4A9C6-E414-425C-AE8B-FE4DD7B25244' () by: 1, reason: Image '' is not available for emulation. When the image is ready, emulation will resume

All images are downloaded.. cause the error occurs only during the ICAP emulation...

Robert

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Wed, 27 Jun 2018 09:41:23 GMT

Hi Robert,

can you share the output of

# tecli s d i

from the SandBlast appliance ?

Do you use a dedicated GW for ICAP server or do you run ICAP on a SandBlast Appliance ?

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Robert_Mueller — Wed, 27 Jun 2018 10:07:49 GMT

Hi - Wie use a Sandblast Appliance for ICAP.. and a McAfee Proxy as ICAP Client

***********************

# tecli s d i

Hps Scraped Files
==============================================

UID: A925C46A-CCC6-41EA-9703-B8D5B0F1B613
Revision: 200
        Status: Ready
        Size: 3.41GB
        Start Download Time: Fri Jun 1 11:11:36 2018

Base Images
==============================================

Win10 64b,Office 2016,Adobe DC
------------------------------
UID: 10b4a9c6-e414-425c-ae8b-fe4dd7b25244
Revision: 200
        Status: Ready
        Size: 8.67GB
        Start Download Time: Fri Jun 1 11:45:38 2018

UID: 1afbde2e-d593-45a8-a686-6cbd42f37823
Revision: 200
        Status: Ready
        Size: 687.2MB
        Start Download Time: Fri Jun 22 11:26:35 2018

UID: 1b0c5014-714d-47f3-9b10-0b7ee386e745
Revision: 200
        Status: Ready
        Size: 3.50GB
        Start Download Time: Fri Jun 22 11:17:48 2018

Win7 64b,Office 2010,Adobe 11
-----------------------------
UID: 3ff3ddae-e7fd-4969-818c-d5f1a2be336d
Revision: 200
        Status: Ready
        Size: 6.21GB
        Start Download Time: Fri Jun 1 11:25:57 2018

Win7,Office 2013,Adobe 11
-------------------------
UID: 5e5de275-a103-4f67-b55b-47532918fa59
Revision: 200
        Status: Ready
        Size: 4.48GB
        Start Download Time: Fri Jun 1 11:21:39 2018

Software Images
==============================================

Win10 64b,Office 2016,Adobe DC
------------------------------
UID: 10b4a9c6-e414-425c-ae8b-fe4dd7b25244
Revision: 205
        Status: Ready
        Size: 93.72MB
        Start Download Time: Fri Jun 1 11:53:19 2018

UID: 1afbde2e-d593-45a8-a686-6cbd42f37823
Revision: 200
        Status: Ready
        Size: 987.0B
        Start Download Time: Fri Jun 22 11:28:18 2018

UID: 1b0c5014-714d-47f3-9b10-0b7ee386e745
Revision: 200
        Status: Ready
        Size: 1.11KB
        Start Download Time: Fri Jun 22 11:28:16 2018

Win7 64b,Office 2010,Adobe 11
-----------------------------
UID: 3ff3ddae-e7fd-4969-818c-d5f1a2be336d
Revision: 205
        Status: Ready
        Size: 35.49MB
        Start Download Time: Fri Jun 1 11:53:09 2018

Win7,Office 2013,Adobe 11
-------------------------
UID: 5e5de275-a103-4f67-b55b-47532918fa59
Revision: 205
        Status: Ready
        Size: 15.8MB
        Start Download Time: Fri Jun 1 11:53:03 2018

Ready Images
==============================================

Summary
-------
5 images (out of 5) are ready

Win10 64b,Office 2016,Adobe DC
------------------------------
UID: 10b4a9c6-e414-425c-ae8b-fe4dd7b25244
Revision: 234
        Status: Ready
        Size: 322.77MB
        Start Download Time: Fri Jun 1 11:53:19 2018

UID: 1afbde2e-d593-45a8-a686-6cbd42f37823
Revision: 204
        Status: Ready
        Size: 99.17MB
        Start Download Time: Fri Jun 22 11:30:25 2018

UID: 1b0c5014-714d-47f3-9b10-0b7ee386e745
Revision: 204
        Status: Ready
        Size: 372.83MB
        Start Download Time: Fri Jun 22 11:29:31 2018

Win7 64b,Office 2010,Adobe 11
-----------------------------
UID: 3ff3ddae-e7fd-4969-818c-d5f1a2be336d
Revision: 234
        Status: Ready
        Size: 1.0GB
        Start Download Time: Fri Jun 1 11:53:19 2018

Win7,Office 2013,Adobe 11
-------------------------
UID: 5e5de275-a103-4f67-b55b-47532918fa59
Revision: 234
        Status: Ready
        Size: 945.9MB
        Start Download Time: Fri Jun 1 11:53:19 2018

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Thu, 28 Jun 2018 08:25:23 GMT

That looks good so far.

Can you also post the customized TPAPI.py ?

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Rajai_Aweidah — Thu, 01 Nov 2018 11:20:08 GMT

@Robert Mueller

Regarding WIN 10, the id should be added with small letters in $FWDIR/c-icap/scripts/TPAPI.py or else you will see ERROR

image_to_name = {
'e50e99f3-5963-4573-af9e-e3f4750b55e2': 'WinXP,Office 2003/7,Adobe 9',
'7e6fe36e-889e-4c25-8704-56378f0830df': 'Win7,Office 2003/7,Adobe 9',
'8d188031-1010-4466-828b-0cd13d4303ff': 'Win7,Office 2010,Adobe 9.4',
'5e5de275-a103-4f67-b55b-47532918fa59': 'Win7,Office 2013,Adobe 11',
'3ff3ddae-e7fd-4969-818c-d5f1a2be336d': 'Win7 64b,Office 2013,Adobe 11',
'6c453c9b-20f7-471a-956c-3198a868dc92': 'Win8.1 64b,Office 2013,Adobe 11',
'10b4a9c6-e414-425c-ae8b-fe4dd7b25244': 'Win10 64b,Office 2016, Adobe DC'
}
te_images = [
{'id': 'e50e99f3-5963-4573-af9e-e3f4750b55e2', 'revision': 1},
{'id': '7e6fe36e-889e-4c25-8704-56378f0830df', 'revision': 1},
{'id': '8d188031-1010-4466-828b-0cd13d4303ff', 'revision': 1},
{'id': '5e5de275-a103-4f67-b55b-47532918fa59', 'revision': 1},
{'id': '3ff3ddae-e7fd-4969-818c-d5f1a2be336d', 'revision': 1},
{'id': '6c453c9b-20f7-471a-956c-3198a868dc92', 'revision': 1},
{'id': '10b4a9c6-e414-425c-ae8b-fe4dd7b25244', 'revision': 1}

Thanks,
Rajai

Re: ICAP Server on Sandblast Appliance (TEX)

Tomas_Jurak — Tue, 27 Nov 2018 18:37:06 GMT

Hi Thomas, thanks for all the info. I set up ICAP server on SandBlast appliance and it is running. We want proxy server (Kernun) to send files for inspection to the SandBlast over ICAP. However, we get errors - 400 bad request:
access.log:

22/Nov/2018:12:34:10 +0100, 10.1.1.1 10.2.2.2 RESPMOD - 400 - '-' '-'

(where 10.1.1.1 is SandBlast, 10.2.2.2 is proxy)

server.log:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Error 4 while parsing headers :(163)
Thu Nov 22 12:26:28 2018, 8606/4137208720, There are unparsed data od size 311: "12b
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /86-0-Intended-use.html was not found on this server.</p>
<hr>
<address>Apache/2.4.10 (Debian) Server at www.eicar.org Port 80</address>
</body></html>

"
. Move to connection buffer
Thu Nov 22 12:26:28 2018, 8606/4137208720, Log request to access log file /opt/CPsuite-R77/fw1/log/c-icap/access.log
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:
Thu Nov 22 12:26:28 2018, 8606/4137208720, Width: 0, Parameter:X-Infection-Found
Thu Nov 22 12:26:28 2018, 8606/4137208720, Waiting for a request....

We cooperate with proxy developer who can make changes to ICAP implementation on their side. But we lack information what does Check Point expect. The proxy uses standard ICAP which works with other anti-virus vendors.

Extended logging and debug are on.

Any suggestions please?

Re: ICAP Server on Sandblast Appliance (TEX)

Thomas_Werner — Wed, 28 Nov 2018 15:05:07 GMT

Hi Tomas,

ICAP 400 means we do not understand your request.

Basically we are using C-ICAP as base ICAP server which is taking RFC ICAP.

We made it work out of the box with Squid, McAfee, Bluecoat.

So there seems to be something wrong with the way the request is created.

Maybe TAC can help you - so please open a ticket with our support.

Regards Thomas

Re: ICAP Server on Sandblast Appliance (TEX)

Leonardo_Ferrei — Mon, 11 Mar 2019 14:12:33 GMT

Hello,

Great topic! Very useful.

We are getting the 404 error in the access.log, but the service is up. Did anyone get the same issue?

We are running the ICAP server in the sandblast appliance with GAIA R80.20

# ps aux | grep c-icap
admin 2865 0.0 0.0 1744 516 pts/2 S+ 10:54 0:00 grep c-icap
admin 20940 0.0 0.2 239832 32912 ? Ss 10:36 0:00 c-icap -N -f /opt/CPsuite-R80.20/fw1/c-icap/etc/c-icap.conf
admin 20944 0.0 0.1 352516 17416 ? Sl 10:36 0:00 c-icap -N -f /opt/CPsuite-R80.20/fw1/c-icap/etc/c-icap.conf
admin 20946 0.0 0.1 352516 17208 ? Sl 10:36 0:00 c-icap -N -f /opt/CPsuite-R80.20/fw1/c-icap/etc/c-icap.conf
admin 20961 0.0 0.1 352516 17212 ? Sl 10:36 0:00 c-icap -N -f /opt/CPsuite-R80.20/fw1/c-icap/etc/c-icap.conf

172.17.10.2 = SANDBLAST APPLIANCE
172.17.10.210 = THIRD PARTY PROXY

#access.log
11/Mar/2019:10:55:41 -0300, 172.17.10.2 172.17.10.210 REQMOD icap://172.17.10.2:1344/sandblast 404

#server.log

Mon Mar 11 10:55:41 2019, 20944/3857472400, Error 7 while parsing headers :(337)
Mon Mar 11 10:55:41 2019, 20944/3857472400, There are unparsed data od size 172: "GET /msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?60168b87a8622854 HTTP/1.1
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: ctldl.windowsupdate.com

c"
. Move to connection buffer
Mon Mar 11 10:55:41 2019, 20944/3857472400, Log request to access log file /opt/CPsuite-R80.20/fw1/log/c-icap/access.log
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Width: 0, Parameter:
Mon Mar 11 10:55:41 2019, 20944/3857472400, Waiting for a request....

Best Regards,

Leonardo Santos

Re: ICAP Server on Sandblast Appliance (TEX)

Leonardo_Ferrei — Mon, 18 Mar 2019 13:20:05 GMT

Hi,

I've realized there is no need to put all the information on the client side (icap://172.17.10.2:1344/sandblast), It was necessary to inform only the service "sandblast".

tcpdump stream between SANDBLAST and Third Party solution:

REQMOD icap://172.17.10.2:1344/icap://172.17.10.2:1344/sandblast ICAP/1.0

Host: 172.17.10.2:1344

X-Client-IP: 172.17.10.201

X-Server-IP: 200.189.123.13

X-Authenticated-User: TG9jYWw6Ly9hbm9ueW1vdXM=

X-Authenticated-Groups: TG9jYWw6Ly9sb2NhbGhvc3Qvbm8gYXV0aGVudGljYXRpb24=

User-Agent: FortiOS

Encapsulated: req-hdr=0, null-body=489

Re: ICAP Server on Sandblast Appliance (TEX)

chico — Wed, 25 Sep 2019 07:49:31 GMT

Hello,

I configured the ICAP server on checkpoint R80.20, we use a F5 BIG-IP as a client ICAP. I configured the icap_uri value as mentionend on the checkpoint documentation "/sandblast" but with this value I get the error log

"24/Sep/2019:17:12:58 +0200, ICAPserver ICAPclient REQMOD sanblast 404

After configured the icap_uri value "avscan" the scan work pretty well

24/Sep/2019:16:55:24 +0200, ICAPserver ICAPclient REQMOD avscan?allow204=on&sizelimit=off&mode=simple 200

Tue Sep 24 16:55:24 2019, 492/3921324944, VIRUS DETECTED: Unknown , http client ip: x.x.x.x, http user: -

So someone could tell me why the value "sanblast" seems doesn't work ?

Best regards,