Views:
On-premises gateways support integration with third-party Internet Content Adaptation Protocol (ICAP) servers. The ZTSA on-premises gateway acts as an ICAP client, forwarding outbound traffic to ICAP servers via REQMOD for DLP scanning and taking action based on your Internet Access Rules.
Note
Note
Predefined DLP rules are available with built-in DLP engines for all gateway types. Third-Party ICAP servers can only be used for on-premises getaways that are not configured in ICAP mode.
Each ICAP server profile can have up to 20 servers.

Procedure

  1. On the TrendAI Vision One™ console, go to Zero Trust Secure Access → Secure Access Configuration → Internet Access and AI Secure Access Configuration.
  2. On the Global Settings tab, click 3rd Party DLP Integration via ICAP protocol.
  3. Click Add.
  4. Enter the Profile name.
  5. You can enter a description of the ICAP profile if you want.
  6. Enter your ICAP servers:
    1. Click Add server.
    2. Enter the Server FQDN/IP address.
    3. You can enable ICAP over SSL if you want.
    4. Enter the Port number.
    5. Enter the Weight of the server.
    6. Enter the REQMOD path.
  7. Enter the maximum number of concurrent connections.
  8. Enter the Timeout.
  9. Select the Failure Action:
    • Allow (Default)
    • Block
  10. Select the X-Headers to stamp in the ICAP request:
    • X-Authenticated-User
    • X-Server-IP
    • X-Client-IP
  11. In the Parse the result from the given X-Header in ICAP response field enter response header that the ICAP server returns after scanning content.

Next steps

Once you have created the profile, you can add it to your Internet Access rule.