Security Gateway as ICAP Server

Check Point ICAP Server The ICAP Server functionality in your Security Gateway or Cluster (in versions R80.40 and higher) enables it to interact with an ICAP Client requests, send the files for inspection, and return the verdict. can work with multiple ICAP Clients.

Check Point ICAP Server is supported only on Security Gateways R80.20 and higher, and supports only the Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. and Anti-Virus Check Point Software Blade on a Security Gateway that uses real-time virus signatures and anomaly-based protections from ThreatCloud to detect and block malware at the Security Gateway before users are affected. Acronym: AV. blades. Any other blades in a Threat Prevention profile are ignored. If you enable ICAP Server on the gateway and not enable the Threat Emulation or the Anti-Virus blades, the ICAP Server runs but without inspection.

The ICAP Server operates according to the relevant settings defined for Threat Emulation and Anti-Virus in the selected Threat Prevention profile and engine settings.

ICAP Server functionality is not supported in VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode and ClusterXL Load Sharing mode.

If you enable the ICAP Server on a Check Point Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object:

• You must configure your ICAP Clients to communicate with the applicable Virtual IP Address of the Check Point Cluster.

• ICAP connections do not survive cluster failover.

ICAP Server Actions

Check Point ICAP Server has 3 possible actions:

ICAP Action	Description and Example
Block	ICAP Server sends an error to the ICAP Client The ICAP Client functionality in your Security Gateway or Cluster (in versions R80.40 and higher) enables it to interact with an ICAP Server responses (see RFC 3507), modify their content, and block the matched HTTP connections.. ICAP Server sends a block page to the ICAP Client. For example: A Check Point UserCheck Functionality in your Security Gateway or Cluster and endpoint clients that gives users a warning when there is a potential risk of data loss or security violation. This helps users to prevent security incidents and to learn about the organizational security policy. page presented by the Threat Emulation or Anti-Virus Software Blades.
Continue / Not modified	A default gateway or a proxy server can forward the HTTP Request / Response to its original destination.

ICAP Server Sample Workflow

Configuring ICAP Server for Threat Prevention

You can create a new ICAP service and select it instead of the default service.

The new service now appears in the drop-down Service list.

When you enable ICAP Server on the gateway object, an auto-generated rule is created in the Threat Prevention Rule Base All rules configured in a given Security Policy. Synonym: Rulebase.. One rule is created for each gateway that has ICAP Server enabled. You can only configure the profile column in this rule. You can select a different profile for each ICAP rule. Unlike other Threat Prevention rules, you cannot create exceptions for an ICAP rule.

Note - ICAP Server supports only Anti-Virus deep-scan. Any additional functionality, such as MD5 hash, URL reputation, and signature-based protection, is not supported.

For information on how to test ICAP Server functionality, see sk174487.

Advanced ICAP Server Configuration on the Security Gateway

The ICAP Server) uses processes to handle the requests it receives from the ICAP Client. Each process generates multiple threads, and each thread handles one request from the ICAP Client to the ICAP Server.

The ICAP Server supports dynamic scaling of the number of processes for optimal performance. The number of available threads increases or decreases as needed. The minimum number of processes is three.

Threat Prevention Settings and ICAP Server

The ICAP Server operates according to the relevant settings defined for Threat Emulation and Anti-Virus in the selected Threat Prevention profile and engine settings.

Emulation Connection Handling Mode and ICAP Server

In the Threat Prevention default profiles (Basic, Optimized, and Strict), Threat Emulation is set to Rapid Delivery mode.

Rapid Delivery mode means that connections are allowed until emulation is complete.

In Maximum Prevention mode, the connections are blocked until emulation is complete. You can create a new profile and change the mode to Maximum Prevention mode, and apply the profile to the relevant gateways.

Related Configuration on the ICAP Client

When you work with Check Point ICAP Server, make sure to set this configuration on your ICAP Client.

Notes: For a detailed explanation on how to configure a Check Point ICAP Client, see Security Gateway as ICAP Client. For a detailed explanation on how to configure a third party ICAP Client, see vendor's documentation.

Use Case

You can use the ICAP technology to communicate HTTPS content.

You are a system administrator, who manages a network that includes a third party gateway/proxy and a Check Point Security Gateway.

The Check Point Security Gateway enforces the Threat Emulation and Anti-Virus blades.

The third party gateway/proxy has HTTPS Inspection Feature on a Security Gateway that inspects traffic encrypted by the Secure Sockets Layer (SSL) protocol for malware or suspicious patterns. Synonym: SSL Inspection. Acronyms: HTTPSI, HTTPSi. enabled, but the Check Point Security Gateway does not.

With the ICAP Client and Check Point ICAP Server enabled and configured to work together, the ICAP Client can send the decrypted traffic to the ICAP Server for inspection. This way, the Check Point Security Gateway can read the HTTPS content for the Threat Emulation and Anti-Virus blades, even if no HTTPS Inspection is enabled on the Check Point Security Gateway.