If you upgrade your NetScaler to the latest 14.1 to support Duo, make sure to follow their procedure to remove the new headers if you want to use iframe for a while. Also make sure to bind them to your Gateway as well as the AAA site. Then once you migrate from iframe to oAuth you can remove the rewrites. https://help.duo.com/s/article/8990?language=en_US