Content of ICAP response sent by Network Prevent for Web to a proxy against a block response rule

Products

• Data Loss Prevention Network Prevent for Web

Issue/Introduction

What is the content of ICAP response sent by Symantec Data Loss Prevention (DLP) Network Prevent for Web server to a proxy against a block response rule?

Environment

DLP Network Prevent for Web, BlueCoat or IBM Aspera proxy

Resolution

DLP Network Prevent for web will send a rejection message that is mentioned in the Block Web Communication response rule as an ICAP response to a proxy server.
By default we have below mentioned line as the rejection message which will be sent to the proxy server in the ICAP response:

"Your web posting was blocked because it violated the company's security policies."

• ICAP/1.0 200 OK (seen when modifications are made, blocks for example)
• ICAP/1.0 204 OK (seen when no modifications are made)
• If the request was blocked you should see an HTTP/1.1 200 OK response inside of the ICAP/1.0 200 OK response.
• You may also see the Block text as specified in the policy response block rule.