Description
In some environments, the only device that is allowed to connect directly to the web is the cache appliance. In such cases, the Vital Security Web Appliance must be configured to proxy its connections through the cache appliance. When the cache appliance is also an ICAP client, it is important to ensure that the Vital Security's transactions do not receive ICAP processing.
Symptoms
When transactions that originate from the Vital Security Web Appliance are scanned through ICAP, users might report lengthy scanning times for Java applets and ActiveX controls. If a sniffer is used to analyze the traffic, the administrator might see the same code (for example, a Java .class file) being requested multiple times. Additionally, updates might not install.
Cause
All Vital Security Web Appliances, regardless of role, must be able to connect to the Internet. The reason for this is broken out by role below:
All in One / Policy Server: These appliances must connect to the Internet in order to download both security and operating system updates.
All in One / Scanning Server: These appliances must connect to the Internet in order to prefetch content for scanning purposes. A common scenario in which prefetching occurs is when Vital Security analyzes a Java .class file that has dependencies on other Java .class files. Vital Security will request all of the associated .class files so that the entire applet can be scanned as a whole.
If transactions originating from the Vital Security appliances are passed back via ICAP, then the appliances may waste cycles scanning updates that do not need to be scanned. Additionally, prefetched content will be double-scanned, and this could result in scanning recursion and double-prefetching, which will increase system utilization and decrease overall performance.
Solution
The best way to prevent scanning loops is to configure the ICAP client (the cache appliance) so that transactions that originate from the IP addresses of the Vital Security Web Appliances do not receive ICAP processing. Neither REQMOD nor RESPMOD processing should be performed on transactions that originate from Vital Security. Additionally, if the IP addresses of the appliances are ever changed, the policy on the cache appliances should be updated so that transactions originating from the new IP addresses are not scanned.
Please note that these configurations are only necessary when the Vital Security Web appliances use an ICAP-enabled cache appliance as their upstream proxy. This includes any situations where the traffic might be transparently redirected to the ICAP-enabled cache appliance. However, when Vital Security appliances are allowed to connect directly to the Internet (without going through the cache appliance), there is no need to apply these configurations on the cache appliance.
Different cache appliances (and different versions of the same cache appliance) can vary in their configuration. For details on configuring a specific cache appliance to bypass ICAP for connections that originate from Vital Security's IP, we recommend contacting the vendor of the cache appliance. The vendor will be able to identify the best way to apply this configuration in your environment.
VSOS
all SWG versions
- This article applies to:
- NG 5000
- SWG 3000 / NG 6000
- SWG 7000 / NG 8000
- This article was previously published as:
- Finjan KB 1096
