This message was deleted.

There's not been any config changes to the NetScaler other than adding a couple IPs to this dataset recently. Yes, I realize all they have to do is change the IP and they're able to hit it again - so far this hasn't really been an issue. This allows me to make the alerts stop before the network team gets around to blocking it on the perimeter firewall.

Hi, I realised a similar thing with the rewrite policies on vpn vserver. I had them as normal Response Polcies and - I guess after some update - they stopped working. They only started to work again as I used the AAA Response as a bind point. It could easily be the same for the responder policies. The question is when did it stop working?

Well, I added a new IP to the data set earlier in the week and I saw the policy hit counter incrementing at that time, so it seems like sometime between then and Friday night, oddly. There'd been no other changes to the config, so it made me wonder if the method of attack/credential submission was being done differently this time.

that's strange, in my case I thought it was an update that broke the binding to the "normal" request. could the hit count increase come from other requests? Or another type of request. There must be a diffrence between aaa requests and other ones eventhought I never find a documenation or specification to clearify this

not really, this policy is only bound to the gateway vserver specifically