topic Re: ICAP Server on VM appliance in Firewall and Security Management

ICAP Server on VM appliance

Arthur_DENIS1 — Wed, 09 Jul 2025 13:25:58 GMT

Hi guys,

I'm currently working on a POC to replace an ICAP server by a checkpoint.

To do this POC, we deploy a GAIA R81.20 as standalone appliance, then enable ICAP server and AV blade, and play with c-icap to validate if it working as expected or not.

as far I can see, it's not the case.
Whatever the test we do, I got: "No modification needed (Allow 204 response"

Even if I put an eicar file as tests.

(see my screenshot)

I try from a demo point environement, but get the same behavior.

If we enable debug, we can see that verdict by blade is always "unknown" (see other screenshot)

Could you please help me to understand the issue ?

Thanks,
Arthur

Re: ICAP Server on VM appliance

Chris_Atkinson — Wed, 09 Jul 2025 23:59:26 GMT

In terms of background could you please confirm:

*Jumbo take ?

*License ?

*Blade update status & connectivity to check point cloud services?

* Deep scanning enabled for AV?

Re: ICAP Server on VM appliance

Arthur_DENIS1 — Fri, 11 Jul 2025 09:17:04 GMT

Hi @Chris_Atkinson

Sorry for delay

On customer environment we try with R81.20 JHF105.
We are using full trial license.
Blade are up to date with connectivity to cloud services via a proxy

On demo point, i have R81.20 JHF84
Extended trial license in place, connectivity to checkpoint cloud services and update ok.

Deep scanning was disabled - I will check with deep scanning and keep you informed

Re: ICAP Server on VM appliance

Chris_Atkinson — Fri, 11 Jul 2025 23:54:08 GMT

The TP admin guide says AV isn't supported for ICAP otherwise so hopefully this was the answer, keep us posted on your progress

Re: ICAP Server on VM appliance

Arthur_DENIS1 — Tue, 15 Jul 2025 08:49:59 GMT

Seems indeed working as expected now, thanks for pointing me to this solution