This message was deleted.
# citrix-netscalers
Slackbot
11/08/2023, 8:37 AMThis message was deleted.
j
Jan Tytgat
11/08/2023, 12:49 PMPBR?
k
Kari Ruissalo (WyW)
11/08/2023, 12:49 PMPrevent using PBR? It's a connected interface...
j
Jan Tytgat
11/08/2023, 12:50 PMWell you could limit incoming traffic to the NSIP/Management SNIP by source address
Jan Tytgat
11/08/2023, 12:51 PMI’d expect that to work, if not you could use ip checks in your authentication policies. (Protect nsroot with a very long and complex password and don’t use local accounts)
k
Kari Ruissalo (WyW)
11/08/2023, 1:42 PMUsing PBRs rather than ACLs? We do have nsroot with complex passwords and LDAP as the primary method for auth. I'm just thinking this in security perspective, we have segmented the NSIPs to management network to get protected from possible vulnerabilities in the Management (GUI/CLI), but just realized that all the VPN users can connect to these interfaces even if they're not included in the split VPN configs.
j
Jan Tytgat
11/08/2023, 1:59 PMWhat does your deny ACL look like?
k
Kari Ruissalo (WyW)
11/08/2023, 4:21 PMadd ns acl acl_drop_vpn-pool-all_to-nsip DENY -srcIP = ds_vpn_pool_all -destIP = ds_hdc_management_nsips -priority 100000 -state ENABLEDKari Ruissalo (WyW)
11/08/2023, 4:22 PMds_vpn_pool_all is a dataset that contains the range for vpn ip pools and the ds_hdc_managment_nsips contains two unique IPs for the management interfaces (NSIPs)
j
Jan Tytgat
11/08/2023, 4:22 PM(very quick and stupid question, but did you apply the ACL?) 😄
k
Kari Ruissalo (WyW)
11/08/2023, 4:22 PMI did! 😄
Kari Ruissalo (WyW)
11/08/2023, 5:53 PMI need to double check my stuff and try this without the datasets
✅ 1