Symptoms
ASM drops ICAP and HTTP connections when a multipart request arrives to the ASM enforcer and then forwarded to the ICAP server for virus inspection, and the ICAP server replies with a large (greater then 10 KB) response.
Impact
ASM drops ICAP and HTTP connections.
Conditions
-- ASM provisioned.
-- ASM policy attached to a virtual server.
-- Antivirus service IP and port defined in the BIG-IP GUI under Options :: Integrated Services.
-- Antivirus protection enabled in the ASM policy.
Workaround
Configure the ICAP server to send back responses smaller than 10 KB.
Fix Information
There is new ASM internal parameter introduced to make the ICAP response buffer size configurable within the ASM enforcer. The maximum response buffer size is 250 KB. To set the variable, issue the following commands, in sequence:
-- /usr/share/ts/bin/add_del_internal add icap_response_buff_size 250000
-- bigstart restart asm
