I'm trying to only allow only US locations as well as local subnet (192.168.1.x) to a Netscaler Gateway. The only way i can get it to work is using '&&' in the policy. Shouldn't this be an '||' statement? It doesn't work with '||'. Here's what i'm using. !CLIENT.IP.SRC.MATCHES_LOCATION("*.US...*.*") && !CLIENT.IP.SRC.IN_SUBNET(192.168.1.0/24). Note that 192.168.1.1 is not defined in the geo database.

|| is or, is that what you meant by as well as? like if US or if on that local IP space? Also the bangs would mean not, so you have these on a responder -> i assume?

You would need it to be an || (or) not an && (and)

I had such trouble figuring out how to type... in my head it just sounded wrong

|| is or,

That's the thing, it only works with the &&, it doesn't work with the ||

Probably want to split it to 2 vips, 1 outside, 1 inside

Blarg!

Have you tried:

!(CLIENT.IP.SRC.MATCHES_LOCATION("*.US.*.*.*.*") || CLIENT.IP.SRC.IN_SUBNET(192.168.1.0/24))

I'm assuming the action is blocking access? Or then have two separate policies, one for internal, one for US. Also, I have ran in to problems using "drop" as the action, because firewall might intepret the connection "pending" and just sending "reset" might give the firewall a better "understanding" that the connection is not ok.

that does seem to work @Kari Ruissalo (WyW), nice! Amazing how many auth attempts there were before enabling this. Think it was like every 10 seconds I'd see a random username trying to login.

What license level you're on?

it's a platinum license, i do have the WAF enabled it on it as well.

What about IP rep?

no ip reputation, but that does look good as well

+ bot mgmt... I think both are pretty easy to enable

and the ip reputation is just AppFW policy? So i just create that pol/prof and it should apply to the netscaler gateway, as long as it's enabled for Auth/VPN on the AAA Settings?

You can run it also in a responder expression

gotcha, so just another responder policy (CLIENT.IP.SRC.IPREP_IS_MALICIOUS APPFW_BLOCK) with a lower number priority and a 'reset' action attached to it? Something like that?

https://docs.netscaler.com/en-us/citrix-adc/current-release/reputation/ip-reputation I'm using mainly

CLIENT.IP.SRC.IPREP_IS_MALICIOUS

as the Responder expression and then depending on the environment and firewall setup the action for that policy is either drop or reset (I think reset is often better for firewalls to avoid filling up the session table). Also, if you run iprep, you can verify it's able to download the latest database from the log in the article above (shell and then

tail -f /var/log/iprep.log

)

very nice, thanks for the info, going to see if i can get this going in the lab.