FortiNDR (on-premise)
On-premise where solution process and store data on customer’s network. Supports Netflow and OT deployments.
cysaw
Staff
Staff
Article Id 319040
Description This article describes how to troubleshoot when the FortiWeb cannot connect to FortiNDR using ICAP.
Scope

FortiNDR.

Solution
  1. FortiWeb is unable to connect to the FortiNDR after configuring the ICAP configuration in both FortiWeb and FortiNDR.


cysaw_0-1717546121908.png

 

  1. Run the debug command in the FortiNDR to check the issue.

 

diagnose debug icap

  1. If the below error appears from the debug output,  go to step 4.

 

2024-04-02 16:57:51,106 INFO handle_one_request(496) Starting handling single http request from 10.8.8.206:12146

2024-04-02 16:57:51,106 ERROR handle_one_request(509) Current connection from client 10.8.8.206:12146 has no mname, returning HTTP status code 404

NoneType: None

2024-04-02 16:57:51,107 ERROR handle_one_request(525) ICAP Error in connection from client 10.8.8.206:12146, returning HTTP status code 404Nothing matches the given URI

 

     4. In the FortiWeb, try to add the service name of the ICAP server setting and verify the result.

cysaw_1-1717546121914.png

 

Contributors