CE-565 with WebSense and ICAP

ronald.change · ‎08-22-2005

My current configuration, which is working fine:

A CE-565 running 5.3.3. It also running the integrated WebSense system. My users are redirected to the CE via WCCP. Caching is enabled on the CE.

Now I need to enable ICAP for anti-virus on the CE. I'll probably use Symantec anti-virus for caching.

I have read the documentation on ICAP, but would like to hear about any experiences you may have had with ICAP, WebSense and caching all runnning on the same CE.

Thanks for your responses,

Ron

CoetzerJ · ‎08-23-2005

I am doing this on a CE511 seems to be working fine, using Trend IWSS though and not Symantec. The only problem we have is getting the reporting in the Trend IWSS to actually logg usernames and not the IP addresses of the hosts downloading the infected files.

Other problems? Well some of the downloaded cab files from windowsupdate are being blocked because it is perceived by the product to contain virusses. Also some of the updated for the product from the site I have also seen being blocked in the logs because of infections ?? not quite sure what the prob is here though.

Only major problem I have found is that the CE sometimes stops responding should the ICAP server be rebooted - which is something to keep in mind.

My Config is below:

icap apply all

icap logging enable

icap append-x-headers x-client-ip

icap append-x-headers x-server-ip

icap append-x-headers x-authenticated-user

icap append-x-headers x-authenticated-groups

icap rescan-cache ISTag-change

icap service trend-reqmod

enable

vector-point reqmod-precache

server icap://serverip/REQ-Service

exit

icap service trend-respmod

enable

vector-point respmod-precache

server icap://serverip/interscan

exit

!

websense-server service policy local activate

websense-server service eim activate

websense-server service user activate

!

websense-server enable

ronald.change · ‎08-23-2005

Thanks for the information on your experience and for sharing your config.

Both are very useful.

I'll update this in a couple weeks for the community to share once I get my changes implemented.