ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To add the ICAP server to the FortiGate in the GUI:
  1. Go to Security Profiles > ICAP Servers.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
  4. Select the IP Version.
  5. In the IP Address field, enter the IP address of the ICAP server.
  6. In the Port field, enter a new port number if required. The default value is 1344.

  7. Click OK.
Tooltip

The maximum number of concurrent connections to ICAP server can be configured in the CLI. The default setting is 100 connections.

To create an ICAP profile in the GUI:
  1. Go to Security Profiles > ICAP.
  2. Click Create New.
  3. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
  4. Enable Request Processing then set the following:
    • Server - Select the ICAP server. In this example, select content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  5. Enable Response Processing then set the following:
    • Server - Select the ICAP server: content-filtration-server4
    • Path - The path to the processing component on the server, such as /proprietary_code/content-filter/.
    • On Failure - Select Error to block the request. If the message cannot be processed, it will not be blocked.
  6. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

  7. Click OK.
To add the ICAP profile to a policy in the GUI: