ICAP with iRule Response Page without ASM

Question

Hello,&nbsp;We are running on Big IP 13.1.1.4 TMOS code and set up Content Adaptation for HTTP request to check files uploaded through one our Website using ICAP. It's working fine but in case any virus is detected the ICAP server modify the response and show it's own response. &nbsp;But we would like to redirect the end-user to a dedicated and corporate web page of our website. I prepared the below Irule but it's now working. &nbsp;when ADAPT_REQUEST_RESULT {&nbsp;&nbsp;if { ([ADAPT::result] contains "respond") } { &nbsp;&nbsp;log local0. "ICAP Response is [ADAPT::result], let's customized reject page"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set response { &nbsp;&nbsp;&nbsp;&lt;html&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;head&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;title&gt;Virus Detected&lt;/title&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta http-equiv="refresh" content="0;URL='https://int-www-01.citizensfla.com/virus-test'" /&gt; &nbsp;&nbsp;&nbsp;&nbsp;&lt;/head&gt; &nbsp;&nbsp;&nbsp;&lt;/html&gt; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::header remove Content-Length &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#HTTP::payload replace 0 [HTTP::payload length] ""&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP::payload replace 0 0 $response&nbsp;&nbsp;&nbsp;} }&nbsp;How we could redirect the POST of the user to a dedicated page within our website if a virus is found using ICAP internal VS.&nbsp;Many thanks in advance for any help on this matter.&nbsp;RegardsVijay

vijay_jain · Answer

Thanks Niels for your response. I tried this Irule but got the Connection timeout error. I created below Irule and it's working as expected-&nbsp;when HTTP_REQUEST {set VirusDetected 0log local0. "AOB-TEST iRule initiated and VirusDetected variable to 0"}when ADAPT_REQUEST_RESULT {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if { ([ADAPT::result request] contains "respond") } {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set VirusDetected 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "ICAP: Check ADAPT VAR: == $VirusDetected =&gt; Virus Found" &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else {&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;set ADAPTvar 0&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;log local0. "ICAP: Check ADAPT VAR: == $VirusDetected=&gt; Virus NOT Found"&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;}&nbsp;&nbsp;&nbsp;&nbsp;}when HTTP_RESPONSE_RELEASE {if { $VirusDetected == 1 } {&nbsp;HTTP::respond 301 Location "https://xxxxx.xxxx.com/virustest"&nbsp;log local0. "redirected to corporate network after Virus was Dectected"&nbsp;&nbsp;&nbsp;}}&nbsp;

niels_van_sluis · Answer

Try this:when ADAPT_REQUEST_RESULT {
    log local0. "ADAPT_REQUEST_RESULT: [ADAPT::result]"
    if { ([ADAPT::result] contains "respond") } {
        log local0. "ICAP Response is [ADAPT::result], let's customized reject page"
        set response {
&lt;html&gt;
  &lt;head&gt;
    &lt;title&gt;Virus Detected&lt;/title&gt;
    &lt;meta http-equiv="refresh" content="0;URL='https://int-www-01.citizensfla.com/virus-test'" /&gt;
  &lt;/head&gt;
&lt;/html&gt;
        }
        HTTP::respond 200 content $response
    }
}

wasfi_bounni · Answer

Of course this i-rule is on the https virtual server not the internal ICAP virtual server, right?

Forum Discussion

ICAP with iRule Response Page without ASM

3 Replies

Recent Discussions

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

SMS server with BIGIP

Related Content

Bypassing ASM on HTTP response

SSL Orchestrator Response Inspection

Client Side SSL Encryption while response from F5

Remover APM Session after send response for user

iRULE regsub error