Data Loss Prevention

Network Prevent for Web Integration - No traffic visible on DLP Console

  • 1.  Network Prevent for Web Integration - No traffic visible on DLP Console

    Posted Feb 21, 2023 08:27 AM

    Hello,

    I am trying to integrate NPW with ICAP supported Firewall (Reverse Proxy).

    I can see the traffic in Wireshark and DLP logs, but it is not visible on Enforce console.

    Given below is the information gathered through WireShark

    -------------------------------------------------------

    OPTIONS icap://10.10.21.32/respmod ICAP/1.0

    Host: 10.10.21.32

    User-Agent: C-ICAP-Client-Library/trunk-1392

    Encapsulated: null-body=0

    ICAP/1.0 200 OK

    ISTag: "Vontu16.0"

    Methods: RESPMOD

    Options-TTL: 3600

    Preview: 0

    Transfer-Preview: *

    Allow: 204

    X-Include: X-Client-IP, X-Authenticated-User

    Encapsulated: null-body=0

    Max-Connections: 16

    RESPMOD icap://10.10.21.32/respmod ICAP/1.0

    Host: 10.10.21.32

    User-Agent: C-ICAP-Client-Library/trunk-1392

    Preview: 0

    Encapsulated: req-hdr=0, res-hdr=194, res-body=310

    POST /owa/service.svc?action=CreateAttachmentFromLocalFile&ID=-55&AC=1 HTTP/1.0

    Last-Modified: Tue Feb 21 13:02:24 2023

    Content-Length: 0

    Content-Length: 0

    User-Agent: C-ICAP-Client/x.xx

    HTTP/1.0 200 OK

    Date: Tue Feb 21 13:02:24 2023

    Last-Modified: Tue Feb 21 13:02:24 2023

    Content-Length: 145210

    0

    ICAP/1.0 100 Continue

    --------------------------------

    Your support is highly appreciated.

    BR

    Atif