Configure ICAP Server

The ICAP Server enables the Gateway to process and manage Internet Content Adaptation Protocol connections to ICAP clients. You must configure the ICAP service to ensure that the Gateway is correctly managing the connections with your ICAP Client.

It is strongly recommended that you disable your ICAP Client from storing cached responses. If caching is enabled, it is possible that policy will not be applied to cached content.

Tell me about...

• The ICAP Server Configuration page

  The Secure ICAP Gateway receives requests from your existing ICAP clients to communicate with the Gateway. This page displays the settings which enable this communication. It includes the ICAP Service URLs, the Listening Ports, and ICAP Services Configuration. You can also add or modify an ICAP client if necessary.

• ICAP/S

  The lightweight Internet Content Adaption Protocol (ICAP) can extend transparent proxy servers and standardize the implementation of new features supporting virus scanning, content filters, etc.

  Unlike HTTP, which supports encryption using HTTPS, it does not natively support encryption. The ICAP/S feature will permit the ICAP server to run on the Gateway securely, allowing it to receive and send back to the client TLS traffic containing the ICAP protocol.

  • In the SIG UI, an additional configuration option has been added to turn ICAP/S on or off. It is off by default for both new installs and upgrades. ICAP/S uses port 11344, which is not configurable in the 5.5.0 release.

  • ICAP/S logs have also been added to the UI. A new date-stamped log file is created each day, and old logs are deleted after 28 days. As with other logs, an alarm will be raised if the logs grow too large, over 50MB.

  • By default, a Clearswift certificate A digital means of proving your identity. When you send a digitally-signed message, you are sending your certificate and public key. Certificates are issued by a certification authority and can expire or be revoked. is used to provide authentication; however, customers can manually copy their own certificate and key file onto the SIG to be used instead.

• ICAP Server Listening Port

  The ports used by the ICAP Gateway to send and receive connections from your ICAP client. ICAP/S can be enabled or disabled from this panel.

• Requests and Responses

  You can enable the ICAP Server to process both or either:

  • Request modification requests
  • Response modification requests
• Message previewing

  Enables previews on requests and responses. It is recommended that Message previewing is enabled.

  The preview size in the ICAP client must be set to 0 so that only headers are sent to the Gateway for analysis.

• Scan HTTPS CONNECTs

  Enables the scanning of HTTPS CONNECTs. When a CONNECT method is received it can be analyzed to enforce the security policy. If your proxy decrypts HTTPS content, the CONNECT method will be followed by HTTP traffic, which will be sent to the Secure ICAP Gateway for inspection.

  If Enable scanning of HTTPS CONNECTs is not enabled and the ICAP client does not send decrypted traffic to the Gateway, it is possible that users will have access to sites which are blocked by your policy.

• ICAP Clients

  The list of currently configured ICAP clients. You can add new IP addresses or change the IP address of existing ICAP clients.

How do I...

• Enable ICAP/S?

  1. Navigate to the Clearswift Secure ICAP Gateway page.

  2. Click System menu > ICAP Server Configuration.

  The grey section at the top identifies active ICAP Service URLs.

  3. The ICAP Server Listening Ports section shows the status of enabled and disabled ports.

  4. Click the blue button in this section to change the settings.

  5. Select the checkbox for Enable ICAP/S on port: 11344, then click Save.

  6. Verify the addition of the active ICAP/S Service URLs in the grey section at the top.

  7. Under ICAP Server Listening Ports, notice ICAP/S is now enabled on port 11344.

• Enable request and response modification requests?

  1. Click System > ICAP Server Configuration.
  2. In the ICAP Services Configuration section, click Click here to change these settings.

  3. Select the type of requests you want the ICAP Server to process.

     Select the Enable message previewing check box. This enables the server to preview requests before processing is performed.

  4. Click Save.
  5. Apply the configuration.
• Add an ICAP client?

  1. Click System > ICAP Server Configuration.
  2. In the ICAP Clients section, click Add.
  3. Enter the IP address of the new ICAP client.
  4. Click Add.

  You can change the IP address of your ICAP clients by selecting a client from the list and clicking Edit.

See also...

• Monitoring the ICAP Server