Solutions

ICAP settings for ProxyAV 2.1

Solutions ID:    KB2899
Version:    1.0
Status:    Published
Published date:    06/01/2009
 

Problem Description

Resolution

The ICAP settings page allows you to configure the ProxyAV to perform content scanning of HTTP content sent as an ICAP request by the Blue Coat ProxySG appliance (serving as the ICAP client).  AS the ProxyAV uses its own antivirus scanning interface, deploying the ProxyAV as an ICAP server is interdependent of other antivirus vendors; the only impact is how each vendor prcesses errors.  These configurations apply to all ICAP clients.

Currently, the ProxyAV only supports the ProxySG as an ICAP client.

To configure ICAP:

  1. Select ICAP Server enabled.
  2. In the ICAP server port field, enter port number used ot connect to the ICAP server.  The default is 1344.
  3. (Optional)  Click the Permitted clients link to go to the Management Console page that defines the IP address of the ICAP client (the ProxySG).
  4. Select Allow 204 response to allow the return of a 204 Not Modified response to the ICAP client when content is not changed.
  5. In the Options TTL field, enter the number of seconds the OPTIONS response remains valid.  If Do not include is selected, the options-ttl tag is not included in the response to the client.
  6. In the Max size of file to scan (KB) field, enter largest file size that is allowed to be sent to the ICAP server.  If the incoming file exceeds this value, no scanning is performed an a 500 Server error is returned.
  7. Specify file types:
    1. In the Transfer Complete field, specify file extensions types (separated by commas) that are returned in the OPTIONS response to the ICAP client (the ProxySG) suggesting which file types can e forwarded the ProxyAV.  All received files are scanned.
    2. In the Transfer Ignore field, enter file extensions that exempt specific file types from scanning (this saves resources).  One of the fields must contain the * character, which means all other files.  The other field lists the file extensions or can be blank.  For example:
      1. Transfer Complete: *
      2. Transfer Ignore: gif, jpg, jpeg
      3. Specifies:  Do not send files with the extensions of gif, jpg, or jpeg; send everything else.
  8. In the Antivirus service name field, specify the name of the ICAP service performing the scanning.  See the example on the page.
  9. Select X-Include to include the X-Include tag (original source and original destinations) in the OPTIONS response to the ICAP client (the ProxySG); thus, the ICAP client is informed that these tags are supported.  This tag includes the X-Client-IP and X-Server-IP values.
  10. Under Include extension headers in response, the default option is X-Virus-ID, which includes the known virus identification.  Select X-Infection-Found or X-Violations-Found if your deployment warrants their use.

Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
 
 
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.
 
 

Your response will be used to improve our document content.

Ask a Question