Next Generation Security Gateway Guide R80.20 | 46
C H A P TE R 4
ICAP Client
In This Section:
Introduction to ICAP ............................................................................................ 46
ICAP Client in Check Point Security Gateway ........................................................ 51
ICAP Client User Disclaimer ................................................................................ 52
Configuring ICAP Client in Gateway mode ............................................................ 53
Configuring ICAP Client in VSX mode ................................................................... 54
The ICAP Client Configuration File ....................................................................... 55
Example of the ICAP Client Configuration File ...................................................... 67
Advanced ICAP Client Configuration .................................................................... 70
Introduction to ICAP
From R80.20, ICAP Client functionality is available in Security Gateway, or Cluster.
Background
The Internet Content Adaptation Protocol (ICAP) is a lightweight HTTP-like protocol, which is
used to extend transparent proxy servers. This frees up resources and standardizes the way in
which new features are implemented. ICAP is usually used to implement virus scanning and
content filters in transparent HTTP proxy caches.
The ICAP allows ICAP Clients to pass HTTP / HTTPS messages to ICAP Servers for content
adaptation. The ICAP Server executes its transformation service on these HTTP / HTTPS
messages and sends responses to the ICAP Client, usually with modified HTTP / HTTPS
messages. The adapted HTTP / HTTPS messages can be HTTP / HTTPS requests, or HTTP /
HTTPS responses.
ICAP is a request and response protocol that is equivalent in semantics and usage to HTTP/1.1.
Despite the similarity, ICAP is neither HTTP / HTTPS , nor an application protocol that runs over
HTTP / HTTPS . ICAP is specified in RFC 3507 https://tools.ietf.org/html/rfc3507 (for more
information, see
ICAP Specification
http://www.icap-forum.org/icap?do=resources&subdo=specification). In addition, see the Draft
RFC - ICAP Extensions https://tools.ietf.org/html/draft-stecher-icap-subid-00.
Usage Examples
• A content provider provides a popular web page with a different advertisement each time the
page is viewed.
• Translation of web pages to different formats that are applicable for special physical devices
(PDA-based or cell-phone-based browsers).
• Firewalls send outgoing HTTP / HTTPS requests to a service that makes sure the URI in the
HTTP / HTTPS request is allowed. In this case, it is an HTTP / HTTPS request that is being
adapted, not an object returned by an HTTP / HTTPS response.
• Users download an executable program through a caching proxy. This proxy acts as an ICAP
client and asks an external server to check the executable for viruses before accepting it into
its cache.
To Next Page