ICAP Server on VM appliance

[Arthur_DENIS1]

Hi guys,

I'm currently working on a POC to replace an ICAP server by a checkpoint.

To do this POC, we deploy a GAIA R81.20 as standalone appliance, then enable ICAP server and AV blade, and play with c-icap to validate if it working as expected or not.

as far I can see, it's not the case.
Whatever the test we do, I got: "No modification needed (Allow 204 response"

Even if I put an eicar file as tests.

(see my screenshot)

I try from a demo point environement, but get the same behavior.

If we enable debug, we can see that verdict by blade is always "unknown" (see other screenshot)

Could you please help me to understand the issue ?

Thanks,
Arthur

[Chris_Atkinson · Accepted solution]

In terms of background could you please confirm:

*Jumbo take ?

*License ?

*Blade update status & connectivity to check point cloud services?

* Deep scanning enabled for AV?

[Arthur_DENIS1]

Hi @Chris_Atkinson 

Sorry for delay

On customer environment we try with R81.20 JHF105.
We are using full trial license.
Blade are up to date with connectivity to cloud services via a proxy

On demo point, i have R81.20 JHF84
Extended trial license in place, connectivity to checkpoint cloud services and update ok.


Deep scanning was disabled - I will check with deep scanning and keep you informed

[Chris_Atkinson]

The TP admin guide says AV isn't supported for ICAP otherwise so hopefully this was the answer, keep us posted on your progress 

[Arthur_DENIS1]

Seems indeed working as expected now, thanks for pointing me to this solution