ProxySG ICAP policy fail_open overrules ICAP policy to block and serve the file
Last Updated December 08, 2017
This is expected behavior.
The ProxySG policy of response.icap_service(virus_scan, fail_open) is designed to fail-open to any errors whether they are health-check related or an error is returned from the ICAP service. Thus, if the ICAP policy is set to block a file extension the ICAP service will return a 500 server error code, as per RFC3705, in which case the SG receives the error and fails-open as per policy.
To implement policy for handling of particular icap error codes in fail-open environments, follow the guidance below: