FortiSandbox ICAP Connectivity Issue

Hi Salhi

Check this document.

https://docs.fortinet.com/document/fortisandbox/5.0.1/administration-guide/939729

Hope it helps.

:package: Prerequisites

On F5 (TMOS 17.x or later):

• Advanced WAF module licensed

• File Protection profile enabled

• SSL interception if HTTPS is involved

On FortiSandbox:

• FortiSandbox 4.0+ (with ICAP enabled)

• Updated AV + sandbox engine

• Network connectivity between F5 and FortiSandbox

:wrench: Step-by-Step Setup

:desktop_computer:️ On FortiSandbox

1. Enable ICAP

1. Login to FortiSandbox Web UI

2. Go to:
   System > Settings > File Scanning

3. Enable ICAP Server

4. Configure:

   • Port: 1344 (default)

   • Service Name: /icap/avscan (default or custom)

   • Allowed clients: Add F5 WAF IP

🟢 Note the service name (e.g. /icap/avscan) — you will use this on F5.

2. Test ICAP is Working

From another system:

You should see:

:globe_with_meridians: On F5 WAF

1. Create ICAP Server Profile

1. Navigate to:
   Security > ICAP Services > ICAP Servers

2. Click Create

3. Fill in:

   • Name: FortiSandbox_ICAP

   • Host: <FortiSandbox-IP>

   • Port: 1344

   • URI Path: /icap/avscan

   • Preview Length: 0

   • Timeout: 5 or 10 seconds

Save and Test Connection.

2. Create ICAP Service

1. Go to:
   Security > ICAP Services > ICAP Services

2. Click Create

3. Fill in:

   • Name: FortiScan_Service

   • Request Adaptation: No

   • Response Adaptation: Yes

   • ICAP Server: FortiSandbox_ICAP

   • Service URI: /icap/avscan

:locked: 3. Attach to Security Policy

1. Go to:
   Security > Application Security > Security Policies

2. Choose your policy

3. Navigate to File Protection

4. Enable:

   • File types to scan (e.g. .doc, .pdf, .exe)

   • ICAP Service: FortiScan_Service

5. Save and Apply Policy

🧪 4. Test with EICAR or Sample Malware

Upload EICAR test file through your app:

• F5 will forward it to FortiSandbox

• If malicious, F5 will block or return a modified response

• FortiSandbox logs verdict in its UI

🧠 Best Practices
Task Recommendation
Enable SSL interception Needed if clients send over HTTPS
Set timeout on ICAP Avoid delay if sandbox is slow
Log FortiSandbox verdicts In FortiSandbox or via Syslog/SIEM
Monitor F5 logs For blocked uploads and ICAP errors
Keep AV/sandbox engine updated On FortiSandbox

:hammer_and_wrench: Optional: Advanced Tuning
Customize FortiSandbox to log, quarantine, or submit unknown files

Use F5 iRules to bypass ICAP for internal or trusted uploads

Use FortiSandbox APIs to fetch detailed reports for detected threats

:white_heavy_check_mark: Summary
Component Key Setting
FortiSandbox ICAP Enabled, URI /icap/avscan
F5 ICAP Server Host + Port + URI /icap/avscan
F5 Policy Enable File Protection
ICAP Mode Response Mode Only (for uploads)

iRule Example: Bypass ICAP for Trusted IPs or URIs

when HTTP_REQUEST {
set skip_icap 0

# Bypass ICAP for internal IPs
if {[IP::client_addr] starts_with "10."} {
set skip_icap 1
}

# Bypass ICAP for specific trusted upload path
if {[HTTP::uri] starts_with "/upload/trusted"} {
set skip_icap 1
}

# Check file extension (only scan specific types)
set uri_path [string tolower [HTTP::uri]]
if {![regexp {(\.exe|\.pdf|\.docx)$} $uri_path]} {
set skip_icap 1
}

# Disable ICAP adaptation if skipping
if {$skip_icap} {
ICAP::disable
log local0. "ICAP bypassed for [IP::client_addr], URI: [HTTP::uri]"
} else {
log local0. "ICAP enabled for [IP::client_addr], URI: [HTTP::uri]"
}
}

Logs

tail -f /var/log/ltm | grep ICAP