Protection Engine returns ICAP/1.0 505 ICAP version not supported

book

Article ID: 198529

calendar_today

Updated On:

Products

Protection Engine for NAS Protection Engine for Cloud Services

Issue/Introduction

When using Symantec Protection Engine (SPE) with the ICAP protocol, it responds to a scan request with ICAP/1.0 505 ICAP version not supported. A packet capture of the scan requests shows a version other than 1.0 was used, for example:

REQMOD /symcscanreq-av-url ICAP/0.1

Cause

SPE only supports ICAP/1.0. Any other version of ICAP will cause it to respond with this error.

Resolution

Work with the developer of your ICAP connector to troubleshoot why it is sending an unsupported ICAP request.

Additional Information

The following are situations that have caused connectors to send unsupported requests:

  • When using F5 LTMs running ASM, failing to restart the service on the LTM after making configuration changes can cause it to send unsupported ICAP requests.
    • To fix this, restart the service. If that does not resolve the issue, work with f5 support to troubleshoot the issue further.
  • When developing an in-house connector, proper syntax has not been followed. A supported request should look similar to:
    • REQMOD icap://192.168.1.101:1344/symcscanreqex-av ICAP/1.0
    • See the Software Developer's Guide and the RFC for ICAP for more information constructing ICAP requests. Connectors are not supported by Broadcom Technical Support.