Fortinet black logo

Administration Guide

ICAP configuration example

ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To configure the ICAP setup in the GUI:
  1. Add the ICAP server:
    1. Go to Security Profiles > ICAP Servers and click Create New.
    2. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
    3. Select the IP Version.
    4. In the IP Address field, enter the IP address of the ICAP server.
    5. In the Port field, enter a new port number if required. The default value is 1344.

    6. Click OK.

    Tooltip

    The maximum number of concurrent connections to ICAP server can be configured in the CLI (set max-connections). The default setting is 100 connections.

  2. Create the ICAP profile:
    1. Go to Security Profiles > ICAP and click Create New.
    2. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
    3. Enable Request Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
    4. Enable Response Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
    5. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

    6. Click OK.
  3. Add the ICAP profile to a policy:
    1. Go to Policy & Objects > Firewall Policy and click Create New.
    2. Set Inspection Mode to Proxy-based.
    3. Under Security Profiles, enable ICAP and select the ICAP server.

    4. Configure the other settings as needed.
    5. Click OK.
To configure the ICAP setup in the CLI:
  1. Add the ICAP server:
    config icap server
        edit "content-filtration-server4"
            set ip-version 4
            set ip-address 172.16.100.55
            set port 1344
            set max-connections 200
        next
    end
  2. Create the ICAP profile:
    config icap profile
        edit "Prop-Content-Filtration"
            set request enable
            set response enable
            set streaming-content-bypass enable
            set request-server "content-filtration-server4"
            set response-server "content-filtration-server4"
            set request-failure error
            set response-failure error
            set request-path "/proprietary_code/content-filter/"
            set response-path "/proprietary_code/content-filter/"
            set methods delete get head options post put trace other
        next
    end
  3. Add the ICAP profile to a policy:
    config firewall policy
        edit 5
            set name "icap_filter3"
            set srcintf "virtual-wan-link"
            set dstintf "virtual-wan-link"
            set srcaddr "FABRIC_DEVICE"
            set dstaddr "FABRIC_DEVICE"
            set dstaddr-negate enable
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "certificate-inspection"
            set icap-profile "Prop-Content-Filtration"
            set logtraffic disable
            set fsso disable
            set nat enable
        next
    end

ICAP configuration example

In this example, the ICAP server performs proprietary content filtering on HTTP and HTTPS requests. If the content filter is unable to process a request, then the request is blocked. Streaming media is not considered by the filter, so it is allowed through and is not processed.

To configure the ICAP setup in the GUI:
  1. Add the ICAP server:
    1. Go to Security Profiles > ICAP Servers and click Create New.
    2. In the Name field, enter a name for the ICAP server, such as content-filtration-server4.
    3. Select the IP Version.
    4. In the IP Address field, enter the IP address of the ICAP server.
    5. In the Port field, enter a new port number if required. The default value is 1344.

    6. Click OK.

    Tooltip

    The maximum number of concurrent connections to ICAP server can be configured in the CLI (set max-connections). The default setting is 100 connections.

  2. Create the ICAP profile:
    1. Go to Security Profiles > ICAP and click Create New.
    2. In the Name field, enter a name for the ICAP profile, such as Prop-Content-Filtration.
    3. Enable Request Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
    4. Enable Response Processing and set the following:
      • Server: select the ICAP server (content-filtration-server4).
      • Path: enter the path to the processing component on the server, such as /proprietary_code/content-filter/.
      • On Failure: select Error to block the request. If the message cannot be processed, it will not be blocked.
    5. Enable Streaming Media Bypass to not offload streaming media to the ICAP server.

    6. Click OK.
  3. Add the ICAP profile to a policy:
    1. Go to Policy & Objects > Firewall Policy and click Create New.
    2. Set Inspection Mode to Proxy-based.
    3. Under Security Profiles, enable ICAP and select the ICAP server.

    4. Configure the other settings as needed.
    5. Click OK.
To configure the ICAP setup in the CLI:
  1. Add the ICAP server:
    config icap server
        edit "content-filtration-server4"
            set ip-version 4
            set ip-address 172.16.100.55
            set port 1344
            set max-connections 200
        next
    end
  2. Create the ICAP profile:
    config icap profile
        edit "Prop-Content-Filtration"
            set request enable
            set response enable
            set streaming-content-bypass enable
            set request-server "content-filtration-server4"
            set response-server "content-filtration-server4"
            set request-failure error
            set response-failure error
            set request-path "/proprietary_code/content-filter/"
            set response-path "/proprietary_code/content-filter/"
            set methods delete get head options post put trace other
        next
    end
  3. Add the ICAP profile to a policy:
    config firewall policy
        edit 5
            set name "icap_filter3"
            set srcintf "virtual-wan-link"
            set dstintf "virtual-wan-link"
            set srcaddr "FABRIC_DEVICE"
            set dstaddr "FABRIC_DEVICE"
            set dstaddr-negate enable
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set ssl-ssh-profile "certificate-inspection"
            set icap-profile "Prop-Content-Filtration"
            set logtraffic disable
            set fsso disable
            set nat enable
        next
    end