Forum Discussion

Marvin_129795's avatar
Marvin_129795
Icon for Nimbostratus rankNimbostratus
Mar 28, 2016

F5 ASM with Mcafee Virusscan for storage ICAP server

Dear all,

 

Working on a integration with F5 ASM with Mcafee Virusscan for storage (ICAP server) and the server keeps sending me HTTP response code 400 Bad Request. Below the configuration and Wireshark output and logs.

 

 

Following is the response code 400

 

 

In ASM request log the following is being logged

 

 

This is the ouput of that log

 

 

 

F5 is configured with /REQMOD as stated in the documentation

 

 

I believe we are using the right solution for ICAP scanning Mcafee Virusscan for storage with ICAP AV scanner enabled version 8.8 hotfix 4 and Enterprise for storage 1.1

 

 

application delivery
ASM Advanced WAF
icap
mcafee
security
virusscan

14 Replies

Sort By
  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Mar 28, 2016
    Also tried to use different URL like /AVSCAN or /reqmod in small letters but all of them ends with the same error. Someone an idea why this is happening?
  • mo_99289's avatar
    mo_99289
    Historic F5 Account
    Mar 29, 2016
    any logs on icap server to find out why it consider that is bad request?
  • Hussein_Ghazy_3's avatar
    Hussein_Ghazy_3
    Icon for Nimbostratus rankNimbostratus
    Mar 29, 2016
    Can you upload tcpdumps for icap server? In the mean time make sure that Virus-header-name under ASM advanced configuration is configured correctly. For McAfee it should look like that: X-Infection-Found,X-Virus-Name. Regards
  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Mar 29, 2016
    The complete reply of the ICAP server is ICAP/1.0 400 Bad request Date: Tue 29 Mar 2016 16:56:06 GMT Service: McAfee VirusScan Enterprise for Storage 1.1.0.127 Service-ID: VSES ISTag: "5800.7501.8114.0"
  • Marvin's avatar
    Marvin
    Icon for Cirrocumulus rankCirrocumulus
    Mar 29, 2016
    X-Infection-Found,X-Virus-Name is already configured as the variable as default. Dont see much logs appearing in the Mcafee Virusscan