FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
ICAP (Internet Content Adaptation Protocol) is an application layer protocol for offloading responsibilities from the firewall to dedicated servers.
Only policies that use proxy-based inspection can use ICAP profiles. When you enable ICAP in a policy, all HTTP and HTTPS traffic intercepted by the policy (if HTTPS inspection is supported) is sent to the ICAP server defined by the selected ICAP profile.
The FortiGate receives responses from the ICAP server and forwards them to their intended destination.
To troubleshoot connection issues between FortiGate and ICAP server:
1) Collect following sniffer output:
# diag sniffer packet any 'host <icap_server_ip> and port 1344' 6 none l
