Planning for ICAP services and ICAP servers

Determining the ICAP services you need

To determine the ICAP services you need, consider the following:

Your organization's requirements for content adaptation
Whether using ICAP services for some or all of your content adaptation needs is the best strategy
In some cases, ICAP services enable you to adapt content in ways that have not been possible previously. In other cases, ICAP services might provide a superior alternative to methods you are using now. See Examples of ICAP services for historical remarks about some services.

Note
To learn about ICAP applications that are available at a given time, check http://www.i-cap.org. Vendors are developing new ICAP applications on an ongoing basis.

Determining how to distribute ICAP services

After you determine the ICAP services that you need, you need to determine how to distribute them. The size and scale of the computers used as ICAP servers and the specific services you select will influence your options for distributing ICAP services. Consult your ICAP vendors for recommendations.

The following table shows methods of distributing ICAP services.

You can run...	Comments
A single service on one ICAP server	A common recommendation is to deploy ICAP services in this manner.
Multiple services on one ICAP server	This type of distribution of ICAP services is likely to be uncommon. An ICAP server must have the capacity to support multiple ICAP applications. Overloading an ICAP server will affect performance of ICAP services. Compatibility issues might exist between ICAP services from different vendors.
The same service on multiple ICAP servers	You might want to run the same service on more than one ICAP server. For example, you might want to run more than one copy or more than one version of a specific virus scanning application to handle the volume of content you expect origin servers to return in response to requests. Based on information you provide in your NetCache ICAP configuration, NetCache then balances the traffic load over all copies and versions of the same application. You specify how load balancing is to occur by service--round robin, IP address, or least usage.

You can run...

Comments

A single service on one ICAP server

A common recommendation is to deploy ICAP services in this manner.

Multiple services on one ICAP server

This type of distribution of ICAP services is likely to be uncommon. An ICAP server must have the capacity to support multiple ICAP applications. Overloading an ICAP server will affect performance of ICAP services.

Compatibility issues might exist between ICAP services from different vendors.

The same service on multiple ICAP servers

You might want to run the same service on more than one ICAP server. For example, you might want to run more than one copy or more than one version of a specific virus scanning application to handle the volume of content you expect origin servers to return in response to requests.

Based on information you provide in your NetCache ICAP configuration, NetCache then balances the traffic load over all copies and versions of the same application. You specify how load balancing is to occur by service--round robin, IP address, or least usage.

Multiple ICAP services adapting the same content

Multiple ICAP services can adapt the same content. For example, you might want the same content to be checked for viruses and translated from one language to another. When you configure your NetCache appliances for ICAP service, you specify the order in which the ICAP services that are invoked at the same vectoring point will be applied. For example, for content returned by the origin server--the response modification vectoring point--a reasonable order for services to be applied is as follows:

Scan the content for viruses
Insert advertisements
Translate the content to another language
Note
Ordering applies only when the services are installed on different ICAP servers.

Considering network traffic when determining ICAP services

Ensure that your network can accommodate the number of ICAP services that you want to provide.

Adding ICAP services to your network might increase network traffic. The reason is that the NetCache appliance must pass a request it receives or content it fetched from the origin server to the ICAP server before it processes the request or content. For example, if a single ICAP service processed every byte of every page, it might create an ICAP traffic load that is twice as large as your HTTP origin server fetching load. However, if your NetCache appliance has a 50 percent hit rate, ICAP would be invoked only 50 percent of the time.

Considerations for ICAP servers

Consult your ICAP vendors for recommendations about the number of services that can run on a particular vendor's ICAP server and how many ICAP servers are required for a particular ICAP application.

Network link recommendation

The link to the ICAP services should have as much bandwidth capacity as the link to the clients and the upstream network.

Location of the NetCache appliances and ICAP servers

For the highest level of security and performance, locate the ICAP server and NetCache appliance on a switched network or private network segment. For best performance, ensure that the ICAP server remains well connected to the client; that is, do not locate the ICAP server at another site, which could cause high latency. Also, ensure that a slow link does not exist between the ICAP server and the client.

If a NetCache appliance and the ICAP servers it works with are on opposite sides of a firewall, work with your firewall administrators to ensure that ports on the firewalls are configured to allow the NetCache appliance to send traffic to and receive traffic from the ICAP servers.

Failover if an ICAP server goes down

If an ICAP server becomes unavailable, the NetCache default behavior is to automatically bypass ICAP services if they become unavailable. Optionally, you can configure your NetCache appliance so that it does not bypass an ICAP service but, instead, returns an error message to the client.

ICAP supports multiple ICAP servers. Therefore, you can install the same ICAP service on more than one ICAP server. Then, if one ICAP server running the service is unavailable, requests are balanced over the remaining ICAP servers running the service.

Note
Carefully consider the effects of suspending or bypassing specific services. For example, if you have content filtering software set up to block access to stock quotes on the Internet for all employees but employees in the finance department, is it acceptable to you that all employees could access stock quotes if the ICAP server becomes unavailable? If you are using ICAP virus scanning and the ICAP server becomes unavailable, would you want to allow documents into your network without checking them for viruses?