Check Point R80.20 - Page 49

ICAP Client
Next Generation Security Gateway Guide R80.20 | 49
Item
Description
2 The Proxy server.
3 The Server computer on the Internet.
4 The ICAP Client component that runs on the Proxy server (2).
5 The ICAP Server component that runs on some computer on the network.
6 The Threat Emulation component that runs on some computer on the network.
A The Client computer (1) initiates a file download from the Server computer (3).
B The Proxy server (2) forwards the file download request to the Server computer (3).
C The Server (3) sends the requested file.
D The ICAP Client component (4) intercepts the downloaded file and sends it to the ICAP
Server component (5).
E The ICAP Server component (5) forwards the downloaded file to the Threat Emulation
component (6) for examination, whether this file is malicious.
F The Threat Emulation component (6) returns its verdict about the downloaded file.
G The ICAP Server component (5) returns one of these to the ICAP Client component (4):
• A block message.
• The modified file.
H The ICAP Client component (4) forwards one of these responses from the ICAP Server
component (5) to the Client computer (1):
• A block message.
• The modified file.
ICAP response codes
These are the ICAP response codes that are different from their HTTP counterparts (each code
consists of 3 digits denoted as xyz):
Category
Code
Description
1
yz
Informational codes
100 Continue after ICAP preview.
2
yz
Success codes
204 No Content. No modification is required.
206 Partial Content.
4
yz
Client error codes
400 Bad request.
404 ICAP Service not found.
405 Method not allowed for service (for example, RESPMOD
requested for service that supports only REQMOD).
408 Request timeout. ICAP Server gave up while it waited for a
request from an ICAP Client.
418 Bad composition. ICAP Server needs encapsulated sections
different from those in the request.
5yz Server error codes
500 Server error. Error on the ICAP Server, such as "out of disk
space".