Fortinet black logo

Cookbook

ICAP configuration example

Copy Link
Copy Doc ID af0e75e9-211f-11ea-9384-00505692583a:170723
Download PDF

ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To add the ICAP server to the FortiGate in the GUI:
  1. Go to Security Profiles > ICAP Servers.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
  4. Select the IP Version.
  5. In the IP Address field, enter the IP address of the ICAP server.
  6. In the Port field, enter a new port number if required. The default value is 1344.

  7. Click OK.
Tooltip

The maximum number of concurrent connections to ICAP server can be configured in the CLI. The default setting is 100 connections.

To create an ICAP profile in the GUI:
  1. Go to Security Profiles > ICAP.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
  4. Enable Request Processing then set the following:
    • Server - Select the ICAP server. In this example, select content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  5. Enable Response Processing then set the following:
    • Server - Select the ICAP server: content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  6. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

  7. Click OK.
To add the ICAP profile to a policy in the GUI:
  1. Go to Policy & Objects > IPv4 Policy.
  2. Click Create New.
  3. Configure the policy as needed to apply to the required traffic.
  4. Set Inspection Mode to Proxy-based.
  5. Under Security Profiles, enable ICAP and select the ICAP server.

  6. Click OK.
To configure the ICAP setup in the CLI:
  1. Add the ICAP server:
    config icap server
        edit "content-filtration-server4"
            set ip-version 4
            set ip-address 172.16.100.55
            set port 1344
            set max-connections 200
        next
    end
  2. Create the ICAP profile:
    config icap profile
        edit "Prop-Content-Filtration"
            set request enable
            set response enable
            set streaming-content-bypass enable
            set request-server "content-filtration-server4"
            set response-server "content-filtration-server4"
            set request-failure error
            set response-failure error
            set request-path "/proprietary_code/content-filter/"
            set response-path "/proprietary_code/content-filter/"
            set methods delete get head options post put trace other
        next
    end
  3. Add the ICAP profile to a policy:
    config firewall policy
        edit 5
            set name "icap_filter3"
            set srcintf "virtual-wan-link"
            set dstintf "virtual-wan-link"
            set srcaddr "FABRIC_DEVICE"
            set dstaddr "FABRIC_DEVICE"
            set dstaddr-negate enable
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "certificate-inspection"
            set icap-profile "Prop-Content-Filtration"
            set logtraffic disable
            set fsso disable
            set nat enable
        next
    end

ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To add the ICAP server to the FortiGate in the GUI:
  1. Go to Security Profiles > ICAP Servers.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
  4. Select the IP Version.
  5. In the IP Address field, enter the IP address of the ICAP server.
  6. In the Port field, enter a new port number if required. The default value is 1344.

  7. Click OK.
Tooltip

The maximum number of concurrent connections to ICAP server can be configured in the CLI. The default setting is 100 connections.

To create an ICAP profile in the GUI:
  1. Go to Security Profiles > ICAP.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
  4. Enable Request Processing then set the following:
    • Server - Select the ICAP server. In this example, select content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  5. Enable Response Processing then set the following:
    • Server - Select the ICAP server: content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  6. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

  7. Click OK.
To add the ICAP profile to a policy in the GUI:
  1. Go to Policy & Objects > IPv4 Policy.
  2. Click Create New.
  3. Configure the policy as needed to apply to the required traffic.
  4. Set Inspection Mode to Proxy-based.
  5. Under Security Profiles, enable ICAP and select the ICAP server.

  6. Click OK.
To configure the ICAP setup in the CLI:
  1. Add the ICAP server:
    config icap server
        edit "content-filtration-server4"
            set ip-version 4
            set ip-address 172.16.100.55
            set port 1344
            set max-connections 200
        next
    end
  2. Create the ICAP profile:
    config icap profile
        edit "Prop-Content-Filtration"
            set request enable
            set response enable
            set streaming-content-bypass enable
            set request-server "content-filtration-server4"
            set response-server "content-filtration-server4"
            set request-failure error
            set response-failure error
            set request-path "/proprietary_code/content-filter/"
            set response-path "/proprietary_code/content-filter/"
            set methods delete get head options post put trace other
        next
    end
  3. Add the ICAP profile to a policy:
    config firewall policy
        edit 5
            set name "icap_filter3"
            set srcintf "virtual-wan-link"
            set dstintf "virtual-wan-link"
            set srcaddr "FABRIC_DEVICE"
            set dstaddr "FABRIC_DEVICE"
            set dstaddr-negate enable
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "certificate-inspection"
            set icap-profile "Prop-Content-Filtration"
            set logtraffic disable
            set fsso disable
            set nat enable
        next
    end