Kassinipedia

11 - ICAP and Content Adaptation

Se lee en 2 min

11 ICAP and Content Adaptation

ICAP (Internet Content Adaptation Protocol, RFC 3507) lets a proxy hand an HTTP request or response to an external ICAP server to be inspected or modified (“adapted”), and then continue with the result. BIG-IP uses it to offload specialized content work away from both the web servers and itself.

ICAP in one line

BIG-IP pauses an HTTP message, sends it to an ICAP server for scanning or modification, and forwards the returned version. ICAP servers listen on TCP 1344.

Why use it

  • Antivirus scanning of uploads and downloads.
  • DLP (data leak prevention) on outgoing content.
  • Language translation of content without loading the web servers.
  • Ad insertion, content filtering, image transcoding.

How it works on BIG-IP

Client → Standard VS (HTTP profile + Request Adapt and/or Response Adapt profile)
             │
             ├──► Internal VS (ICAP profile) ──► ICAP pool (ICAP servers)
             │
             └──► Normal pool (web servers)
  1. The standard VS has an HTTP profile plus a Request Adapt and/or Response Adapt profile.
  2. Request Adapt → before sending the request to the web pool, BIG-IP sends it to an internal virtual server.
  3. The internal VS has an ICAP profile and a pool of ICAP servers — load balanced and monitored like any other pool.
  4. The ICAP server returns the original or modified message, or blocks it.
  5. Response Adapt does the same with the server’s response before it reaches the client.

Key points

  • The VS type that gives access to the ICAP servers is Internal — it’s not reachable directly by clients.
  • The ICAP profile defines the ICAP URI, preview size and headers.
  • If the ICAP pool is down, the Service Down Action of the Request/Response Adapt profile decides what happens: Ignore (let traffic through unadapted — fail-open), Reset or Drop (fail-closed).
  • Reference: BIG-IP LTM Implementations — Configuring Content Adaptation via ICAP.

Self-check

Q1 — When using an ICAP pool, what type of virtual server provides access to the ICAP servers?

Q2 — Your web app goes global in 15 languages and translation must not load the web servers. What type of server would do the translation?

Q3 — Which profiles on the standard VS send traffic to ICAP?