互联网内容适应协议(ICAP)a simple lightweight protocol for running the value-added transformation service on HTTP messages. In a typical scenario, an ICAP client forwards HTTP requests and responses to one or more ICAP servers for processing. The ICAP servers perform content transformation on the requests and send back responses with appropriate action to take on the request or response.
ICAP on a Citrix ADC appliance
In a Citrix ADC setup, the appliance acts as an ICAP client interoperating with third-party ICAP servers (such as antimalware and Data Loss Protection (DLP)). When the appliance receives an incoming web traffic, the appliance intercepts the traffic and uses a Content Inspection policy to evaluate if the HTTP request needs an ICAP processing. If yes, the appliance decrypts and sends the message as a plain text to the ICAP servers. The ICAP servers run the content transformation service on the request message and send back a response to the appliance. The adapted messages can either be an HTTP request or an HTTP response. If the appliance interoperates with multiple ICAP servers, the appliance performs load balancing of ICAP servers. This scenario happens when one ICAP server is not sufficient to handle all the traffic load. Once the ICAP servers return a modified message, the appliance forwards the modified message to the back-end origin server.
The Citrix ADC appliance also provides a secured ICAP service if the incoming traffic is an HTTPS type. The appliance uses an SSL based TCP service to establish a secured connection between the appliance and ICAP servers.
How ICAP request modification (REQMOD) works
In the request modification (REQMOD) mode, the Citrix ADC appliance forwards the HTTP request received from the client to the ICAP server. The ICAP server then performs one of the following:
Sends back a modified version of the request and the appliance in turn sends the modified request to the back-end origin server or it pipelines the modified request to another ICAP server.
Responds with a message indicating no adaptation is required.
Returns an error and the appliance in turn sends the error message back to the user.
How ICAP response modification (RESPMOD) works
In the response modification (RESPMOD) mode, the Citrix ADC appliance sends an HTTP response to the ICAP server (the response sent by the appliance is typically the response sent by the origin server). The ICAP server then performs one of the following:
Sends a modified version of the response and the appliance in turn sends the response to the user or pipelines the response to another ICAP server.
Responds with a message indicating no adaptation is required.
Returns an error and the appliance in turn sends the error message to the user.
ICAP license
The ICAP feature works on a Citrix ADC standalone or high availability setup with Citrix ADC Premium or Advanced license edition.
Configure ICAP for content transformation service
To use ICAP for content transformation service, you must begin by enabling the Content inspection and load balancing features. Once you enable the features, you can complete the following tasks
To enable content inspection
If you want the Citrix ADC appliance to act as an ICAP client, you must first enable the Content Inspection and load balancing features.
At the command prompt, type:
enable ns feature contentInspection LoadBalancing
Add ICAP profile
ICAP configurations for a Citrix ADC appliance are specified in an entity called the ICAP profile. The profile has a collection of the ICAP settings. The settings include parameters to dynamically generate an ICAP request, receive the ICAP response, and log content inspection data.
To dynamically generate an ICAP request to the ICAP server, a new parameter, “insertHTTPRequest” is added to the ICAP profile. If this parameter is configured, the appliance takes the configured value as a policy expression and evaluates the expression and includes the result as an encapsulated HTTP request or response and then sent it to the ICAP server. Also, a new parameter “insertICAPHeaders” is configurable to dynamically evaluate and include the ICAP headers.
When the appliance sends an ICAP request and does not receive a response the ICAP server, the connection becomes unresponsive. It occurs until the ICAP server sends a response or a session gets freed. The behavior can be handled by configuring the ICAP response time-out option. You can set a request time-out parameter for action if there is delayed ICAP response. If the Citrix ADC appliance does not receive a response within the configured request time-out, the request timeout action is performed.
ReqTimeoutAction:可能的值是绕过,复位T, DROP. BYPASS: This Ignores the remote ICAP server’s response and sends the request/response to Client/Server. RESET (default): Reset the client connection by closing it. DROP: Drop the request without sending a response to the user
To evaluate an ICAP response, a new policy expressionICAP.RESis used in the content inspection callout return expression. This expression evaluates the ICAP response similar to theHTTP.RESexpression in aHTTP_CALLOUT.
例如,当a Citrix ADC appliance receives an HTTP request for a service hosted behind the Citrix ADC virtual IP address, the appliance might have to check the client’s authentication with an external server and take an action.
To dynamically generate content inspection log stream records or SYSLOG logs, you can use the ICAP.RES based policy expression on the ICAP response. This parameter is configurable in the ICAP profile to configure the policy expression to generate the dynamic log records.
set icapProfile reqmode-profile -logAction messageaction
Add ICAP service as a TCP or SSL_TCP service
After you enable the Content Inspection feature, you must add an ICAP service for the ICAP servers that will be part of the load balancing setup. The service that you add provides the ICAP connection between the Citrix ADC appliance and load balancing virtual servers.
Note: As an administrator, you can add an ICAP service and directly configure the ICAP server IP address in the Content Inspection action.
At the command prompt, type the following:
add service
Example:
add service icapsv1 10.10.10.10 SSL_TCP 1345
add service icapsv2 10.10.10.11 SSL_TCP 1345
Add a TCP or SSL_TCP based load balancing virtual server
After creating an ICAP service, you must create a virtual server to accept ICAP traffic and load balance the ICAP servers.
Note:
You can also use an SSL based TCP service over a secured channel. You use a SSL_TCP service and bind to the Content Inspection action.
Bind ICAP service to the load balancing virtual server
After you create an ICAP service and virtual server, you must bind the ICAP service to the virtual server.
At the command prompt, type the following:
bind lb vserver
Example:
bind lb vserver vicap icapsv1
Add content inspection action
After you enable the Content Inspection feature, you must add an ICAP action for handling the ICAP request information. The ICAP profile and services, or load balancing virtual server that are created are bound to the ICAP action. If the ICAP server is down, you can configure theifserverdownparameter for the appliance to perform any one of the following actions.
CONTINUE: If the User wants to bypass the content inspection when the remote server is down, you can choose the “CONTINUE” action, as default. RESET (default): This action responds to the client by closing the connection with RST. DROP: This action silently drops the packets without sending a response to the user.
If you can configure the ICAP service instead of a load balancing virtual server, you can mention the service name in the\<-serverip>option. When adding the Content Inspection action, the TCP service is automatically created for the given IP address with port 1344 and it is used for ICAP communication.
After you create a Content Inspection action, you must create content inspection policies to evaluate requests for ICAP processing and audit logging. The policy is based on a rule which consists of one or more expressions. The rule is associated to the content inspection action that is associated if a request matches the rule.
Bind content inspection policies to the content switching or load balancing virtual server
To put an ICAP policy into effect, you must bind it globally or bind it to a Content Switching or load balancing virtual server, which front end the application. When you bind the policy, you must assign a priority to it. The priority determines the order in which the policies you define are evaluated.
Note:
The application virtual server must be of type - HTTP/SSL/CS-PROXY.
For information about configuring a load balancing setup for forwarding the traffic to the back-end origin server after content transformation, seeLoad Balancing.
Configure secured ICAP service
To establish a secured connection between the Citrix ADC appliance and the ICAP web servers, the appliance uses an SSL-based TCP service or load balancing virtual server bound to an ICAP action.
To establish a secured ICAP connection, complete the following tasks:
Add SSL-based TCP service.
Bind SSL-based TCP service to load balancing virtual server of type TCP or SSL_TCP.
Bind SSL-based TCP service or load balancing virtual server to Content Inspection action.
Add SSL-based TCP service to load balancing virtual server
To establish a secured connection between the Citrix ADC appliance and the ICAP web servers, the appliance uses an SSL-based TCP service or load balancing virtual server bound to an ICAP action.
To establish a secured ICAP connection, complete the following tasks:
Add SSL-based TCP service.
Bind SSL-based TCP service to load balancing virtual server of type TCP or SSL_TCP.
Bind SSL-based TCP service or load balancing virtual server to Content Inspection action
Add SSL-based TCP service to load balancing virtual server
After you enable the Content Inspection feature, you must add a secured ICAP service that will be part of the load balancing setup. The service that you add provides a secured ICAP connection between the Citrix ADC appliance and load balancing virtual servers.
At the command prompt, type the following:
add service
Example:
add service icapsv2 10.102.29.200 SSL_TCP 1344 –gslb NONE –maxclient 0 –maxReq 0 –cip DISABLED –usip NO –useproxport YES –sp ON –cltTimeout 9000 –svrTimeout 9000 –CKA NO –TCPB NO –CMP NO
Bind SSL-based TCP service to SSL_TCP or TCP load balancing virtual server
After you create a secured ICAP service, you must bind the service to the load balancing virtual server. It is required if you are using a load balancing virtual server to load balance the ICAP servers.
At the command prompt, type the following:
bind lb vserver
Example:
bind lb vserver vicap icapsv2
Bind SSL-based TCP service or load balancing virtual server to the Content Inspection action
You add an ICAP action for handling the ICAP request information and also bind the SSL-based TCP service to the action.
Navigate toLoad Balancing>Virtual Servers. Add a load balancing virtual server of type HTTP/SSL. Or, you can select a virtual server and clickEdit.
After entering the server basic details, clickContinue.
In theAdvanced Settingssection, clickPolicies.
Go thePoliciessection and click thePencilicon to configure the Content Inspection policy.
On theChoose Policypage, selectContent Inspection. ClickContinue.
In thePolicy Bindingsection, click+to add a Content Inspection policy.
In theCreate ICAP Policypage, enter a name for the policy.
In theAction字段,点击“+”添加一个标志ICAP行动。
In theCreate ICAP Actionpage, enter a name for the action.
Enter a name for the action.
In theServer Namefield, enter the name of the TCP service already created.
InICAP Profilefield, click the “+” sign to add an ICAP profile.
In theCreate ICAP Profilepage, enter a profile name, URI, and MODE.
ClickCreate.
In theCreate ICAP Actionpage, clickCreate.
In theCreate ICAP Policypage, enter “true” in theExpression Editorand then clickCreate.
ClickBind.
When prompted to enable the Content Inspection feature, clickYes.
ClickDone.
For information about the Citrix ADC GUI configuration for load balancing and forwarding the traffic to the back-end origin server after content transformation, seeLoad Balancing.
Configure secured ICAP protocol by using the GUI
Navigate toLoad Balancing>Servicesand clickAdd.
In theServicespage, enter the service details.
Navigate toLoad Balancing>Virtual Servers. Add a virtual server of type HTTP/SSL. Or, you can select a virtual server and clickEdit.
After entering the server basic details, clickContinue.
In theAdvanced Settingssection, clickPolicies.
Go thePoliciessection and click thePencilicon to configure the Content Inspection policy.
On theChoose Policypage, selectContent Inspection. ClickContinue.
In thePolicy Bindingsection, click+to add a Content Inspection policy.
In theCreate ICAP Policypage, enter a name for the policy.
In theAction字段,点击“+”添加一个标志ICAP行动。
In theCreate ICAP Actionpage, enter a name for the action.
Enter a name for the action.
In theServer Namefield, enter the name of the TCP_SSL service already created.
InICAP Profilefield, click the “+” sign to add an ICAP profile.
In theCreate ICAP Profilepage, enter a profile name, URI, and MODE.
ClickCreate.
In theCreate ICAP Actionpage, clickCreate.
In theCreate ICAP Policypage, enter “true” in theExpression Editorand then clickCreate.
ClickBind.
When prompted to enable the Content Inspection feature, clickYes.
ClickDone.
Audit log support for remote content inspection
If an incoming request or outgoing response is content inspected, the Citrix ADC appliance logs the ICAP details. The appliance stores the details as a log message in the ns.log file.
Each log message typically contains the following details:
Example for content inspected request log message:
Example for content inspected response log message:
Apr 18 12:34:08 10.106.97.104 04/18/2018:12:34:08 GMT 0-PPE-0 : default CI ICAP_LOG 71 0 : Source 10.106.97.105:18552 - Destination 10.106.97.99:80 - Domain NA - Content-Type NA - ICAP Server 10.106.97.99:1344 - Mode RESPMOD - Service /example - Response 400 - Action Internal Error
The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.
DIESER DIENST KANN ÜBERSETZUNGEN ENTHALTEN, DIE VON GOOGLE BEREITGESTELLT WERDEN. GOOGLE LEHNT JEDE AUSDRÜCKLICHE ODER STILLSCHWEIGENDE GEWÄHRLEISTUNG IN BEZUG AUF DIE ÜBERSETZUNGEN AB, EINSCHLIESSLICH JEGLICHER GEWÄHRLEISTUNG DER GENAUIGKEIT, ZUVERLÄSSIGKEIT UND JEGLICHER STILLSCHWEIGENDEN GEWÄHRLEISTUNG DER MARKTGÄNGIGKEIT, DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK UND DER NICHTVERLETZUNG VON RECHTEN DRITTER.
CE SERVICE PEUT CONTENIR DES TRADUCTIONS FOURNIES PAR GOOGLE. GOOGLE EXCLUT TOUTE GARANTIE RELATIVE AUX TRADUCTIONS, EXPRESSE OU IMPLICITE, Y COMPRIS TOUTE GARANTIE D'EXACTITUDE, DE FIABILITÉ ET TOUTE GARANTIE IMPLICITE DE QUALITÉ MARCHANDE, D'ADÉQUATION À UN USAGE PARTICULIER ET D'ABSENCE DE CONTREFAÇON.
ESTE SERVICIO PUEDE CONTENER TRADUCCIONES CON TECNOLOGÍA DE GOOGLE. GOOGLE RENUNCIA A TODAS LAS GARANTÍAS RELACIONADAS CON LAS TRADUCCIONES, TANTO IMPLÍCITAS COMO EXPLÍCITAS, INCLUIDAS LAS GARANTÍAS DE EXACTITUD, FIABILIDAD Y OTRAS GARANTÍAS IMPLÍCITAS DE COMERCIABILIDAD, IDONEIDAD PARA UN FIN EN PARTICULAR Y AUSENCIA DE INFRACCIÓN DE DERECHOS.
本服务可能包含由 Google 提供技术支持的翻译。Google 对这些翻译内容不做任何明示或暗示的保证,包括对准确性、可靠性的任何保证以及对适销性、特定用途的适用性和非侵权性的任何暗示保证。
ESTE SERVIÇO PODE CONTER TRADUÇÕES FORNECIDAS PELO GOOGLE. O GOOGLE SE EXIME DE TODAS AS GARANTIAS RELACIONADAS COM AS TRADUÇÕES, EXPRESSAS OU IMPLÍCITAS, INCLUINDO QUALQUER GARANTIA DE PRECISÃO, CONFIABILIDADE E QUALQUER GARANTIA IMPLÍCITA DE COMERCIALIZAÇÃO, ADEQUAÇÃO A UM PROPÓSITO ESPECÍFICO E NÃO INFRAÇÃO.
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.