ICAP limitations with ForcePoint Web Proxy - Check Point CheckMates

ICAP limitations with ForcePoint Web Proxy

Hello,

I wanted to share with you some lessons learned by integrating ForcePoint Web Proxy and Sandblast via ICAP.

We have two TE appliances, integration went well and smooth following the guides in Check Point and some reading of the ICAP RFC, fun part was that we were only emulating uploaded files and no download. (ie: When we uploaded an attachment we could see it being emulated, but when we downloaded any file nothing).

We performed some PCAPs on Download and Upload traffic and we could only see REQMOD and 204 unmodified messages being sent, nevertheless with upload traffic we could see even the file.

After escalating with both vendors, ForcePoint confirmed to us that they only supported uploads via ICAP since they only use it for DLP.

Hope it is useful if you are planning a similar integration.

Regards,

Federico

Tags:

• force point
• forcepoint
• icap
• sandblast

View All ≫

Leaderboard

View All ≫

Trending Discussions

• Bug on LOM Date and Time
• [TIP] Check Point Migration Backup: Collecting Relevant Files Before a Clean Install
• [INFO] Why Can Gaia Configure LOM If LOM Is Supposed to Be Independent?

Upcoming Events

Sort by:

• All

• Virtual

• In-Person

• Under the Hood - Check Point and Illumio – Modern Network Defense Against AI-Based Threats

• The AI Security Report 2026: A Turning Point for Enterprise Defense - SGT

• The AI Security Report 2026: A Turning Point for Enterprise Defense - AMER

• The AI Security Report 2026: A Turning Point for Enterprise Defense EMEA

• TechTalk: On-Premise SD-WAN Management

• CheckMates Live DFW: Agentic AI Security Deep Dive & Hands-On