This article applies to:
Question:
In what environment should the ICAP mode be used?
Reply
In what environment should the ICAP mode be used?
ICAP Operation Mode lets you set up an R3000 with a proxy server – The ICAP option (System > Mode > Operation Mode) is used only if this R3000 will function with an ICAP server to off-load content from the source R3000 server, such as Internet filtering. The ICAP Server Settings frame is used for configuring options response settings for the ICAP R3000 server. When an end user makes a request for Internet content, this request is routed to the proxy server, which then submits the request to the ICAP server. The ICAP server sends back a response to the proxy server—which may send the request to the original R3000 server in some network setups, and then return a response to the proxy server. Based on the end user's filtering profile, the proxy server either fulfills the request or returns a block page.
NOTE: When using the ICAP mode, the following items must be taken into consideration:
In order for Tier 3 authentication to work correctly with the ICAP mode, the virtual IP used for authentication has to be a real and available IP address.
The proxy server must be configured to not forward any traffic to the R3000's virtual IP (used for authentication) via ICAP, or else the Tier 3 applet will be blocked if the R3000 is configured to block uncategorized sites.
To display block pages correctly and to prevent “looping,” the proxy server must be configured to not forward any traffic to the R3000 via the ICAP server. Looping occurs in environments in which an R3000 is filtering traffic from end users to an internal proxy.
Also to prevent "looping," if a custom URL is being used for the X Strikes block page, the proxy must be configured to not forward any traffic to that custom URL.
In order for the authentication form to display correctly, the proxy server must be configured to accept the certificate coming from port 8081 of the R3000 as being valid.
Since the authentication form is only accessible via HTTPS, the proxy server must be configured to give workstations access to HTTPS sites from the R3000.
- This article was previously published as:
- 8e6 KB 292284