Protocol transparency for ICAP
FortiGate incorporates the original client protocol type (such as, HTTP, HTTPS, FTP, FTPS, SFTP, and SCP) into the ICAP header through the X-Forwarded-Proto field, enhancing integration with FortiData as the ICAP server. This enables FortiData to have full information about the client protocol used, allowing it to enforce security according to corporate security policies.
For example, the client-side ICAP packet captures includes the X-Forwarded-Proto field, as follows:
172.016.200.200.02467-172.016.200.044.01344: RESPMOD icap://172.16.200.44:1344/ ICAP/1.0 Host: 172.16.200.44:1344 X-Client-IP: 10.1.100.11 X-Server-IP: 172.16.200.33 X-Forwarded-Proto: HTTPS User-Agent: FortiOS v7.6.1 X-Scan-Progress-Interval: 10 Encapsulated: req-hdr=0, res-hdr=103, res-body=354 GET /icap_test/redirection.html HTTP/1.1 Host: 172.16.200.33 User-Agent: curl/7.68.0 Accept: */* HTTP/1.1 200 OK Date: Tue, 08 Oct 2024 22:24:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 20 Dec 2022 00:41:05 GMT ETag: "al-5f037b0ec71e4" Accept-Ranges: bytes Content-Length: 161 Vary: Accept-Encoding Content-Type: text/html al <html> .<body> .</script> ..<p>It is the target url of redirection on the 172.16.200.33!</p> ..<p>ICAP server has redirected the request</p> .</body> </html> 0