ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To add the ICAP server to the FortiGate in the GUI:

1. Go to Security Profiles > ICAP Servers.
2. Click Create New.
3. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
4. Select the IP Version.
5. In the IP Address field, enter the IP address of the ICAP server.
6. In the Port field, enter a new port number if required. The default value is 1344.

   

7. Click OK.

The maximum number of concurrent connections to ICAP server can be configured in the CLI. The default setting is 100 connections.

To create an ICAP profile in the GUI:

1. Go to Security Profiles > ICAP.
2. Click Create New.
3. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
4. Enable Request Processing then set the following:
   • Server - Select the ICAP server. In this example, select content-filtration-server4
   • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
   • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
5. Enable Response Processing then set the following:
   • Server - Select the ICAP server: content-filtration-server4
   • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
   • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
6. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

   

7. Click OK.

To add the ICAP profile to a policy in the GUI:

1. Go to Policy & Objects > Firewall Policy.
2. Click Create New.
3. Configure the policy as needed to apply to the required traffic.
4. Set Inspection Mode to Proxy-based.
5. Under Security Profiles, enable ICAP and select the ICAP server.

   

6. Click OK.

To configure the ICAP setup in the CLI:

1. Add the ICAP server:

   config icap server
       edit "content-filtration-server4"
           set ip-version 4
           set ip-address 172.16.100.55
           set port 1344
           set max-connections 200
       next
   end

2. Create the ICAP profile:

   config icap profile
       edit "Prop-Content-Filtration"
           set request enable
           set response enable
           set streaming-content-bypass enable
           set request-server "content-filtration-server4"
           set response-server "content-filtration-server4"
           set request-failure error
           set response-failure error
           set request-path "/proprietary_code/content-filter/"
           set response-path "/proprietary_code/content-filter/"
           set methods delete get head options post put trace other
       next
   end

3. Add the ICAP profile to a policy:

   config firewall policy
       edit 5
           set name "icap_filter3"
           set srcintf "virtual-wan-link"
           set dstintf "virtual-wan-link"
           set srcaddr "FABRIC_DEVICE"
           set dstaddr "FABRIC_DEVICE"
           set dstaddr-negate enable
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "certificate-inspection"
           set icap-profile "Prop-Content-Filtration"
           set logtraffic disable
           set fsso disable
           set nat enable
       next
   end