The ICAP service on Intelligent Virtual Execution - Server appliances can block REQMOD and RESPMOD requests received from ICAP clients. When ICAP blocking is enabled, detection of a potential threat causes the appliance to block the requested data and instead serve the client browser a HTTP comfort page.
The following example shows the HTTP comfort page response served by a Intelligent Virtual Execution - Server appliance acting as an ICAP server to a client browser:
.png)
Note
The ICAP service is disabled by default. Enabling the ICAP service does not automatically enable ICAP blocking mode. However, the ICAP blocking comfort page is enabled by default.
You can enable or disable ICAP blocking mode by using the Intelligent Virtual Execution - Server appliance CLI.
Enabling or disabling ICAP blocking mode using the CLI
icap-service block-mode enable no icap-service block-mode enable
Configuring the verdict timeout for ICAP blocking mode
When ICAP blocking mode is enabled, the appliance holds the connection open while waiting for the analysis verdict. By default, the ICAP connection remains open for up to 300 seconds. If analysis takes longer, the file is allowed to download to avoid excessive user wait times.
You can now configure the verdict timeout for ICAP blocking mode. This setting determines how long the ICAP connection waits for the analysis verdict before allowing the connection to proceed.
Use the following CLI command to configure the verdict timeout:
Syntax
icap-service block-mode verdict-timeout <seconds>
Parameters
<seconds>
The maximum time in seconds to hold the connection while waiting for an analysis verdict. The value ranges from 0-300 seconds and the default value is 300.
Response codes
The status codes returned by the ICAP server in response to requests from the ICAP client:
Code | Status | Description |
|---|---|---|
100 | Continue | Continue after ICAP preview. |
200 | OK | The request has succeeded. |
204 | Allow | No modifications required. |
400 | Bad request | Indicates that the request sent by the ICAP client is invalid. |
403 | Forbidden, found malicious | Request forbidden. |
404 | Service not found | ICAP service not found. |
500 | Internal server error | The ICAP server encountered an unexpected condition or error that prevented it from fulfilling the request. |
When a file is received through ICAP, it is submitted for analysis. By default, the ICAP connection remains open for up to 300 seconds (5 minutes) to allow for the analysis to complete. If the analysis does not finish within this time, the scan is considered timed out, and the file is allowed to be downloaded. However, once the analysis is eventually completed in the background, the result is stored in the cache. If the same file is submitted again later and the previous verdict was clean, the cached result is returned immediately, avoiding the need for re-analysis.