This website uses cookies. By clicking Accept, you consent to the use of cookies. Click Here to learn more about how we use cookies.
Accept
Reject
ABOUT CHECKMATES & FAQ
Create a Post
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Help
FedericoMeiners
Advisor
‎2019-09-25 05:07 AM

ICAP limitations with ForcePoint Web Proxy

Hello,

I wanted to share with you some lessons learned by integrating ForcePoint Web Proxy and Sandblast via ICAP.

We have two TE appliances, integration went well and smooth following the guides in Check Point and some reading of the ICAP RFC, fun part was that we were only emulating uploaded files and no download. (ie: When we uploaded an attachment we could see it being emulated, but when we downloaded any file nothing).

We performed some PCAPs on Download and Upload traffic and we could only see REQMOD and 204 unmodified messages being sent, nevertheless with upload traffic we could see even the file

After escalating with both vendors, ForcePoint confirmed to us that they only supported uploads via ICAP since they only use it for DLP.

Hope it is useful if you are planning a similar integration.

Regards,

Federico

____________
https://www.linkedin.com/in/federicomeiners/
0 Replies
This widget could not be displayed.