FortiSandbox ICAP Connectivity Issue

[Salhi_El_Mehdi]

Dear community,

I'm trying to integrate an F5 WAF with FortiSandbox using ICAP on port 1344. The goal is to have the F5 WAF send PDF files to FortiSandbox for analysis.

I have configured both the F5 WAF and FortiSandbox accordingly, but ICAP connectivity is not working. I also attempted to telnet to the FortiSandbox IP (ICAP server) on port 1344, but the connection was refused (even though ping works fine).

My questions are:

1. Are there any methods to test ICAP connectivity and troubleshoot the issue to determine whether the problem is on the F5 or FortiSandbox side?
2. Is a FortiSandbox license required for integration with the F5 WAF?

Thank you in advance

[AEK]

Hi Salhi

Check this document.

https://docs.fortinet.com/document/fortisandbox/5.0.1/administration-guide/939729

Hope it helps.

[Salhi_El_Mehdi]

Hi AEK

Thank you for your reply.

I already checked the Fortinet documentation but couldn't find the necessary information.

[sajidalisajid]

:package: Prerequisites

On F5 (TMOS 17.x or later):

• Advanced WAF module licensed

• File Protection profile enabled

• SSL interception if HTTPS is involved

On FortiSandbox:

• FortiSandbox 4.0+ (with ICAP enabled)

• Updated AV + sandbox engine

• Network connectivity between F5 and FortiSandbox

:wrench: Step-by-Step Setup

:desktop_computer:️ On FortiSandbox

1. Enable ICAP

1. Login to FortiSandbox Web UI

2. Go to:
   System > Settings > File Scanning

3. Enable ICAP Server

4. Configure:

   • Port: 1344 (default)

   • Service Name: /icap/avscan (default or custom)

   • Allowed clients: Add F5 WAF IP

🟢 Note the service name (e.g. /icap/avscan) — you will use this on F5.

2. Test ICAP is Working

From another system:

bash

CopyEdit

curl -i -X OPTIONS icap://<fortisandbox-ip>:1344/icap/avscan

You should see:

makefile

CopyEdit

ICAP/1.0 200 OK Methods: RESPMOD

:globe_with_meridians: On F5 WAF

1. Create ICAP Server Profile

1. Navigate to:
   Security > ICAP Services > ICAP Servers

2. Click Create

3. Fill in:

   • Name: FortiSandbox_ICAP

   • Host: <FortiSandbox-IP>

   • Port: 1344

   • URI Path: /icap/avscan

   • Preview Length: 0

   • Timeout: 5 or 10 seconds

Save and Test Connection.

2. Create ICAP Service

1. Go to:
   Security > ICAP Services > ICAP Services

2. Click Create

3. Fill in:

   • Name: FortiScan_Service

   • Request Adaptation: No

   • Response Adaptation: Yes

   • ICAP Server: FortiSandbox_ICAP

   • Service URI: /icap/avscan

---

:locked: 3. Attach to Security Policy

1. Go to:
   Security > Application Security > Security Policies

2. Choose your policy

3. Navigate to File Protection

4. Enable:

   • File types to scan (e.g. .doc, .pdf, .exe)

   • ICAP Service: FortiScan_Service

5. Save and Apply Policy

---

🧪 4. Test with EICAR or Sample Malware

Upload EICAR test file through your app:

• F5 will forward it to FortiSandbox

• If malicious, F5 will block or return a modified response

• FortiSandbox logs verdict in its UI

[sajidalisajid]

🧠 Best Practices
Task Recommendation
Enable SSL interception Needed if clients send over HTTPS
Set timeout on ICAP Avoid delay if sandbox is slow
Log FortiSandbox verdicts In FortiSandbox or via Syslog/SIEM
Monitor F5 logs For blocked uploads and ICAP errors
Keep AV/sandbox engine updated On FortiSandbox

:hammer_and_wrench: Optional: Advanced Tuning
Customize FortiSandbox to log, quarantine, or submit unknown files

Use F5 iRules to bypass ICAP for internal or trusted uploads

Use FortiSandbox APIs to fetch detailed reports for detected threats

:white_heavy_check_mark: Summary
Component Key Setting
FortiSandbox ICAP Enabled, URI /icap/avscan
F5 ICAP Server Host + Port + URI /icap/avscan
F5 Policy Enable File Protection
ICAP Mode Response Mode Only (for uploads)

[sajidalisajid]

iRule Example: Bypass ICAP for Trusted IPs or URIs

when HTTP_REQUEST {
set skip_icap 0

# Bypass ICAP for internal IPs
if {[IP::client_addr] starts_with "10."} {
set skip_icap 1
}

# Bypass ICAP for specific trusted upload path
if {[HTTP::uri] starts_with "/upload/trusted"} {
set skip_icap 1
}

# Check file extension (only scan specific types)
set uri_path [string tolower [HTTP::uri]]
if {![regexp {(\.exe|\.pdf|\.docx)$} $uri_path]} {
set skip_icap 1
}

# Disable ICAP adaptation if skipping
if {$skip_icap} {
ICAP::disable
log local0. "ICAP bypassed for [IP::client_addr], URI: [HTTP::uri]"
} else {
log local0. "ICAP enabled for [IP::client_addr], URI: [HTTP::uri]"
}
}

Logs

tail -f /var/log/ltm | grep ICAP