Configuring ICAP services efficiently for Content Analysis

Products

• ProxySG Software - SGOS

Issue/Introduction

How do I streamline ICAP to reduce unnecessary load as much as possible on the Content Analysis?

Resolution

1. Secure Web Gateway - Content Analysis Policy Best Practice Improvement
2. Manage queued connections on the ProxySG appliance. Do this from the ProxySG management console here: Configuration > External Services > Icap.
   Choose the response and/or request service > edit :
   “Defer scanning at threshold %” – in the icap service.  This will queue files that take long to scan – lower the threshold to lower the load on the ProxyAV.  NB, there is no option to do this by protocol. 
   "Maximum number of connections” – increase to increase the load on the SG, and regulate the load on the Content Analysis (Refer to maximum connections, Maximum ICAP Connections)
   “Connection timeout” – this is a blunt instrument to cut scans that take too long – can cause user complaints for large downloads, but can be useful to set a strict download ceiling and thus save system resources for devices that are overloaded.