cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

ICAP error 16007

Jump to solution

Hi,

How to deal with such error: "(16007) ICAP client filter error: Property cannot be calculated in response cycle"?

And what is the reason for that?

Best Regards,
Mariusz

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: ICAP error 16007

Jump to solution

Hi,

 

Hope you are doing well.

 

When DLP filtering was applied to web traffic going on under ICAP, an ICAP client error occurred due to processing a file with embedded objects that had been sent in response to a download request, but still using a REQMOD request to forward the file. (WP-2266)

 

The issue is that REQMOD property was being calculated in response embedded cycle which was wrong.

 

Below is seen in mwg core error.log:-

 

[2020-06-16 17:44:29.755 +08:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle
[2020-06-16 17:45:12.060 +08:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

 

DLP with ICAP ruleset is enabled for request and embedded cycle, If you try to download a file containing embedded objects the request should fail with error 'The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

[2020-04-23 09:00:12.903 +02:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

The error comes when defining REQMOD property for response cycle.

 

The rule does not have response cycle enabled. As embedded cycle is enabled and if response embedded cycle comes, this rule will get hit and we try to calculate REQMOD property in response embedded cycle which is wrong.. Thats why this error

 

You need to add additionally Cycle.TopName equals Request as the entry criteria to the DLP rule and then error wont come.

 

Along with the current criteria's in that rule, you need to add Cycle.TopName equals Request

 

Add an additional rule criteria as "Cycle.TopName equals Request" in the DLP with ICAP ruleset.

 

Below is also some information for your reference:-

 

Actually we gave full fix in 7.8.2.19, By full fix I mean changes in the backend code and in the ruleset.

 

The default ruleset in the library has also changed in the fixed versions. Now the default rule criteria for ‘Data Loss Prevention(DLP) with ICAP’ in the rule set library to "URL.Host does not equal “” AND Cycle.TopName equals Request".

 

For customers who are already using the ruleset will have to recreate the ruleset after the upgrade or will have to add the "Cycle.TopName equals Request" as the entry criteria to the DLP rule.

 

 

Was my reply helpful? If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
 
 
Regards
Alok Sarda

View solution in original post

2 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: ICAP error 16007

Jump to solution

Hi,

 

Hope you are doing well.

 

When DLP filtering was applied to web traffic going on under ICAP, an ICAP client error occurred due to processing a file with embedded objects that had been sent in response to a download request, but still using a REQMOD request to forward the file. (WP-2266)

 

The issue is that REQMOD property was being calculated in response embedded cycle which was wrong.

 

Below is seen in mwg core error.log:-

 

[2020-06-16 17:44:29.755 +08:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle
[2020-06-16 17:45:12.060 +08:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

 

DLP with ICAP ruleset is enabled for request and embedded cycle, If you try to download a file containing embedded objects the request should fail with error 'The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

[2020-04-23 09:00:12.903 +02:00] [ICAPClientFilterPlugin] [NoReqModPropInRespMod] The property com.scur.engine.icapclient.reqmod.satisfaction cannot be calculated in the response cycle

 

The error comes when defining REQMOD property for response cycle.

 

The rule does not have response cycle enabled. As embedded cycle is enabled and if response embedded cycle comes, this rule will get hit and we try to calculate REQMOD property in response embedded cycle which is wrong.. Thats why this error

 

You need to add additionally Cycle.TopName equals Request as the entry criteria to the DLP rule and then error wont come.

 

Along with the current criteria's in that rule, you need to add Cycle.TopName equals Request

 

Add an additional rule criteria as "Cycle.TopName equals Request" in the DLP with ICAP ruleset.

 

Below is also some information for your reference:-

 

Actually we gave full fix in 7.8.2.19, By full fix I mean changes in the backend code and in the ruleset.

 

The default ruleset in the library has also changed in the fixed versions. Now the default rule criteria for ‘Data Loss Prevention(DLP) with ICAP’ in the rule set library to "URL.Host does not equal “” AND Cycle.TopName equals Request".

 

For customers who are already using the ruleset will have to recreate the ruleset after the upgrade or will have to add the "Cycle.TopName equals Request" as the entry criteria to the DLP rule.

 

 

Was my reply helpful? If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
 
 
Regards
Alok Sarda

View solution in original post

Re: ICAP error 16007

Jump to solution

Hi Alok

I've added the "Cycle.TopName equals Request" as the entry criteria to the DLP rule and my problem has gone away.
Thank you for your help.

Besta Regards
Mariusz

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community