Getting Started with ICAP Server

1. From the left navigation panel, click Gateways & Servers.

2. Double-click the Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / Cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. object.

3. From the left tree, go to ICAP Server.

4. Select Enable ICAP Server.

5. In Service, the default service is TCP ICAP, which runs on port 1344.

   Optional: You can create a new ICAP service and use it instead of the default service

   1. Go to the Object Explorer and select New > More > Service > TCP.

   2. Enter the object name and add a comment if necessary.

   3. In General, do not select a protocol.

   4. In Match By, select the Port you want the service to run on.

   5. Optional: Configure the Advanced features. For a detailed explanation on the advanced service features, check the online help.

   6. Click OK

      The new service now appears in the drop-down Service list.

   Optional: You can create a new ICAP service to work over TLS
   

   From R81.20, Check Point Security Gateway supports encrypted connection between the ICAP Server The ICAP Server functionality in your Security Gateway or Cluster (in versions R80.40 and higher) enables it to interact with an ICAP Client requests, send the files for inspection, and return the verdict. and ICAP Client The ICAP Client functionality in your Security Gateway or Cluster (in versions R80.40 and higher) enables it to interact with an ICAP Server responses (see RFC 3507), modify their content, and block the matched HTTP connections..

   1. Go to the Object Explorer and select New > More > Service > TCP.

   2. Enter the object name and add a comment if necessary.

   3. In General, do not select a protocol.

   4. In Match By, select the Port you want the service to run on.

   5. Optional: Configure the Advanced features. For a detailed explanation on the advanced service features, check the online help.

   6. Click OK.

   7. Create the CA certificate and ICAP Server certificate through your application of choice.

   8. Export the certificates in PEM file formats:

   9. Copy the server certificate "icapcert.pem" to the Security Gateway / each Cluster Member Security Gateway that is part of a cluster. to some directory (for example, /home/admin).

   10. Connect to the command line on the Security Gateway / each Cluster Member.

   11. Log in to the Expert mode.

   12. Edit the ICAP Server configuration file:

       vi $FWDIR/c-icap/etc/c-icap.conf

   13. Add this line with the path of the server certificate:

       TlsPort [port_number] cert=/home/admin/icapcert.pem

   14. Save the changes in the file and exit the editor.

   15. Load the updated ICAP Server configuration with this command on the Security Gateway / each Cluster Member.:

       icap_server reconf

   16. Copy the CA certificate PEM file of the ICAP Server to the ICAP Client.

   17. Configure the ICAP Client so it is able to connect to the ICAP Server over TLS. Note these parameters:

       • ICAP protocol (icaps - for TLS).

       • ICAP Server IP address and port number.

       • Direct the ICAP modification requests to the ICAP Server SandBlast service.

       • TLS specifications

       For example:

       Third party ICAP Client (Squid) configuration:

       Copy

       adaptation_send_client_ip on
       adaptation_send_username on
       icap_client_username_encode on
       icap_client_username_header X-Authenticated-User
       icap_service service_req_pre reqmod_precache icaps://<IP_ADDRESS>:<PORT_NUMBER>/sandblast tls-cafile=<CERTIFICATE_FILE> tls-domain=<DOMAIN_NAME>
       icap_service service_req_post reqmod_postcache icaps://<IP_ADDRESS>:<PORT_NUMBER>/sandblast tls-cafile=<CERTIFICATE_FILE> tls-domain=<DOMAIN_NAME>
       icap_service service_resp_pre respmod_precache icaps://<IP_ADDRESS>:<PORT_NUMBER>/sandblast tls-cafile=<CERTIFICATE_FILE> tls-domain=<DOMAIN_NAME>
       icap_service service_resp_post respmod_postcache icaps://<IP_ADDRESS>:<PORT_NUMBER>/sandblast tls-cafile=<CERTIFICATE_FILE> tls-domain=<DOMAIN_NAME>
       adaptation_access service_req_post allow all
       adaptation_access service_resp_pre allow all
       adaptation_access service_resp_post allow all

6. Configure Fail Mode - In case of an error, configure if requests to the ICAP server are blocked or allowed.

7. You can configure an implied rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. for ICAP in the Access Control policy.

8. Click OK.

When you enable ICAP Server in the Security Gateway or Cluster object, SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. automatically creates a rule in the Threat Prevention Rule Base All rules configured in a given Security Policy. Synonym: Rulebase..

One rule is created for each Security Gateway / Cluster that has ICAP Server enabled.

Configure the applicable action in the Action column of this rule.

You can select a different profile for each ICAP rule.

 

Notes: In Threat Extraction > UserCheck settings, if you want to allow the user access the original file, you must configure access from the internal network to the ICAP server. This way, the client is able to download the original files (the internal network is connected to the ICAP client and not directly to the gateway or ICAP Server). Unlike other Threat Prevention rules, you cannot create exceptions for an ICAP rule. In Threat Emulation > General > Protected Scope, Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE. scans all files, regardless of the option you select.