Anti-virus Protection through an ICAP Server in F5 ASM/AWAF

F5 ASM/AWAF can integrate with external ICAP servers (Internet Content Adaptation Protocol) to provide anti-virus protection by inspecting HTTP file uploads for viruses before releasing them to the web server. This feature helps ensure that potentially malicious files are detected and blocked early in the web application security process, preventing them from reaching the backend systems.

---

Key Features of Anti-virus Protection via ICAP:

1. Integration with ICAP Servers: F5 ASM can be configured to work as an ICAP client. This setup allows the system to send files for virus scanning to an external ICAP server, where popular anti-virus solutions (like McAfee, Symantec, Kaspersky, or Trend Micro) can inspect them for malicious content.

2. File Types Processed:

   • Multipart and Binary Data: F5 ASM only sends multipart content with binary data to the ICAP server for virus scanning.

   • Non-Binary/Non-Multipart Data: For other content types (e.g., plain text or JSON), Attack Signatures (rather than virus scanning) are applied for security inspection.

3. ICAP Server Setup:

   • To configure the ICAP server, navigate to Security > Options > Application Security > Integrated Services > Anti-Virus Protection in the F5 ASM management interface.

   • F5 ASM can be configured to work with various popular anti-virus programs that support ICAP, such as:

     • McAfee

     • Symantec

     • Kaspersky

     • Trend Micro

4. Guarantee Enforcement:

   • The "Guarantee Enforcement" setting ensures that virus checking is always performed, even under performance conditions where resources are limited. This is crucial for maintaining the integrity of the security checks.

5. Blocking Settings (Virus Detected Violation):

   • F5 ASM allows you to configure what happens when a virus is detected in a file upload. You can choose to either block or alarm the violation.

   • Navigate to Security > Application Security > Learning and Blocking Settings > Policy General Features to set these options.

6. System Variables for ICAP Configuration:

   • For integration with the ICAP server, system variables such as icap_uri (ICAP server address) and virus_header_name (header name indicating virus detection) must be set up.

   • Navigate to Security > Options > Application Security > Advanced Configuration > System Variables to configure these variables.

   • By default, the Virus_Header_Name is set to "X-Virus-Name" and "X-Infection-Found", which are typical for McAfee anti-virus programs, but this can be adjusted for other anti-virus solutions.

---

Steps to Set Up ICAP Server for Anti-virus Protection:

1. Configure ICAP Server Integration:

   • Go to Security > Options > Application Security > Integrated Services > Anti-Virus Protection.

   • Set the ICAP server URI and configure the virus header name as required (e.g., "X-Virus-Name" for McAfee).

2. Enable Guarantee Enforcement:

   • In the Anti-virus Protection settings, enable the "Guarantee Enforcement" option to ensure virus scanning is always performed.

3. Configure Blocking or Alarm for Virus Detection:

   • Go to Security > Application Security > Learning and Blocking Settings > Policy General Features to set the actions for when a virus is detected in a file. You can select to either block the request or trigger an alarm.

4. Set System Variables for ICAP:

   • Navigate to Security > Options > Application Security > Advanced Configuration > System Variables.

   • Set the icap_uri (ICAP server address) and the virus_header_name for virus detection (default: "X-Virus-Name").

---

Considerations:

• Performance: Enabling the Guarantee Enforcement setting ensures that even during high load conditions, the anti-virus checks will still be enforced, but it may impact performance, so ensure that your system can handle this load.

• Supported Anti-virus Solutions: F5 ASM supports integration with popular anti-virus programs (McAfee, Symantec, Kaspersky, and Trend Micro) that support the ICAP protocol. Verify compatibility with your ICAP server and configure it accordingly.

• Blocking vs. Alarming: You can choose whether the system should block file uploads containing viruses or just raise an alarm. For higher security, blocking is recommended, but for monitoring purposes, alarming might be more appropriate.