ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To configure the ICAP setup in the GUI:

1. Add the ICAP server:
   1. Go to Security Profiles > ICAP Servers and click Create New.
   2. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
   3. Select the IP Version.
   4. In the IP Address field, enter the IP address of the ICAP server.
   5. In the Port field, enter a new port number if required. The default value is 1344.

      

   6. Click OK.

   The maximum number of concurrent connections to ICAP server can be configured in the CLI (set max-connections). The default setting is 100 connections.

2. Create the ICAP profile:
   1. Go to Security Profiles > ICAP and click Create New.
   2. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
   3. Enable Request Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
   4. Enable Response Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
   5. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

      

   6. Click OK.
3. Add the ICAP profile to a policy:
   1. Go to Policy & Objects > Firewall Policy and click Create New.
   2. Set Inspection Mode to Proxy-based.
   3. Under Security Profiles, enable ICAP and select the ICAP server.

      

   4. Configure the other settings as needed.
   5. Click OK.

To configure the ICAP setup in the CLI:

1. Add the ICAP server:

   config icap server
       edit "content-filtration-server4"
           set ip-version 4
           set ip-address 172.16.100.55
           set port 1344
           set max-connections 200
       next
   end

2. Create the ICAP profile:

   config icap profile
       edit "Prop-Content-Filtration"
           set request enable
           set response enable
           set streaming-content-bypass enable
           set request-server "content-filtration-server4"
           set response-server "content-filtration-server4"
           set request-failure error
           set response-failure error
           set request-path "/proprietary_code/content-filter/"
           set response-path "/proprietary_code/content-filter/"
           set methods delete get head options post put trace other
       next
   end

3. Add the ICAP profile to a policy:

   config firewall policy
       edit 5
           set name "icap_filter3"
           set srcintf "virtual-wan-link"
           set dstintf "virtual-wan-link"
           set srcaddr "FABRIC_DEVICE"
           set dstaddr "FABRIC_DEVICE"
           set dstaddr-negate enable
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "certificate-inspection"
           set icap-profile "Prop-Content-Filtration"
           set logtraffic disable
           set fsso disable
           set nat enable
       next
   end