ICAP Client in Check Point Security Gateway

The ICAP Client functionality in your Check Point Security Gateway or Cluster enables it to interact with an ICAP Server responses, modify their content, and block the matched HTTP connections. In addition, you can add an ICAP Server decision to the enforcing logic on your Security Gateway, or Cluster.

The ICAP Client functionality in your Check Point Security Gateway or Cluster lets you work with 3rd party devices without changing your network topology.

The ICAP Client feature in your Check Point Security Gateway or Cluster supports these:

• HTTP request modification (ICAP REQMOD).
• HTTP response modification (ICAP RESPMOD).
• HTTPS traffic, which you can send to an ICAP Server.

  Important:

  • You must enable and configure the HTTPS Inspection on your Security Gateway or Cluster.
  • The ICAP Client communication with the configured ICAP Servers is in clear (unencrypted) traffic.
• Multiple ICAP Servers:

  ICAP Client can send the HTTP messages to several ICAP Servers concurrently.

• User-defined ICAP request header extensions (X-Headers):
  • X-Client-IP, X-Server-IP (for the destination host), and X-Authenticated-User (if the ICAP Client knows it).
  • To work with user-defined ICAP response header extension, you must configure them explicitly.
  • See the Draft RFC - ICAP Extensions.
• Data Trickling mode.
• UserCheck.

This ICAP Client functionality was tested against an internal ICAP Server (C-ICAP) and against the Check Point ICAP Server.

Notes:

• There is no full Fail-Open support. In case of HTTP / HTTPS requests or responses with body and with only a single ICAP Server Service, the Fail Mode is always Fail-Close.

  ICAP Client in Check Point Security Gateway can support the Fail-Open with the Trickling From The End mode.

• To inspect IPv6 traffic:
  1. Enable IPv6 support on your Security Gateway or Cluster members
  2. Configure all ICAP Servers with IPv6 addresses.