ICAP Protocol

[Olmedo_Abril_Ar]

Hi.

R80 support ICAP protocol?

[PhoneBoy]

Can you define your specific requirements?

[Olmedo_Abril_Ar]

I have a client who needs to send the log to a Trustwave SIEM integration so this must be done through the ICAP protocol.

[Quinn_Yost]

Generally ICAP​ is used to offload content analysis to another system.   To send Check Point log messages to another system, one would generally use syslog or OpSec.

[Rex_Shang]

Does R80 support ICAP protocol as an ICAP client?  I am looking at having a file analysis engine integrated with CheckPoint and would like to run an ICAP serve to receive the files.

[PhoneBoy]

In read-only mode, yes: Check Point support for Internet Content Adaptation Protocol (ICAP) read-only client 

If you want to modify content based on what the ICAP server says, this is not currently supported in R80.10.

[Rex_Shang]

I am using CheckPoint Security Gateway pay as you go service in AWS and I am not able to open the support solution.  Can you shed some light on the configuration steps to do this?  Much thanks.

[PhoneBoy]

AWS PAYG includes standard support, which should allow access to that SK.

I recommend engaging with our Account Services team.

Contact Support | Check Point Software 

[John_Richards]

Dameon, just wondering if you can comment on sk111305. It appears that Internet Content Adaptation Protocol (ICAP) client with data modifications functionality can be added to Check Point R77.30 Security Gateway on Gaia OS.
This functionality would enable Check Point Security Gateway to interact with an ICAP server's response, to modify content and to block connections. We have a client that would like to do this (send ICAP to a DLP solution) and do not want to go to R80.10 yet. We still are getting mixed messages (it will work...it will not work) from Check Point.

Thanks

[PhoneBoy]

As it is not part of a mainstream release and is meant for specific environments, you will need to work with your local Check Point office.

They should be able to help you determine if the solution is suitable for your specific situation. 

[Alessandro_Marr]

Hello Dameon, is icap client, on R80.20, read-write? 

[PhoneBoy]

Yes.

Refer to: ICAP Client 

[Alessandro_Marr]

Hello Dameon, thank you for the information, another doubt: to use my cluster with a DLP 3rd Party I need to change my configuration to use my gateway as an HTTP proxy on transparent mode as a picture below ?

actual state

settings to use with external DLP

Is correct?

[PhoneBoy]

Don't believe this is required.

[Alessandro_Marr]

ok, thank you Dameon, I will study that link.