Hi imrankhani7,

That really comes down to workflow/preference. There is a white paper that gives a bit more detail and considerations.

If  you are running scan-on-access you will need 1 ICAP per node. If you are running a policy, all nodes need to be on the network.

https://support.emc.com/docu45800_White-Paper:-Antivirus-Solutions-With-EMC-Isilon-Scale-Out-NAS-.pdf?language=en_US

Is there a more updated version since 2013?

Looking to confirm latest supported anti-virus 3rd party apps too.

For 8.1 OneFS

https://support.emc.com/docu84275_OneFS-8.1.0-Security-Configuration-Guide.pdf?language=en_US

For 8.0 OneFS

https://support.emc.com/docu79792_OneFS-8.0.1-Security-Configuration-Guide.pdf?language=en_US

it will use the management IP of the nodes. I have ICAP with McAfee