Hi all, had a question on some of the NetScaler Pr...
# citrix-netscalern
Neal Dolson
11/25/2024, 7:49 PMHi all, had a question on some of the NetScaler Premium edition features, and how/if they'd work to address a particular use case. Our NetScaler Gateway, like most things internet facing, is subject to constant probing by people/bots trying to use generic creds, or sometimes targeted, to authenticate against the Gateway. I'd like to automatically block these IPs when this type of activity occurs.
đź‘Ť 1
Neal Dolson
11/25/2024, 7:52 PMOur physical firewalls aren't doing much beyond layer 4 and I'm not sure they even have geo-IP restrictions set up properly, so I'd like to be able to thwart some of this stuff on the NetScaler itself since I have control over that. What I'd like to happen is for an IP that continuously fails to authenticate to the Gateway to be blocked with some level of hands off-ness and intelligence. It sounds to me, based on the documentation/sales material that the bot mitigation might be the feature we're looking for here. Am I misunderstanding its purpose? I dont have much experience with the premium features on the NS.
Neal Dolson
11/25/2024, 7:54 PMWe've used a data set + responder policy to block frequent offender IPs and that worked OK for a while, but over the past year or so these will come in waves of 10-20 different IPs and blocking them is just wack-a-mole, and still requires manual intervention.
r
Ryan Gallier
11/25/2024, 7:54 PMYou can do a make-shift Geo-IP on the NetScaler
n
Neal Dolson
11/25/2024, 7:55 PMI have looked into that before, but a fair number of them are US based IPs anyhow, which is where my users are located.
r
Ryan Gallier
11/25/2024, 7:56 PMah, oof
Ryan Gallier
11/25/2024, 7:56 PMyeah, i do not know. We have a smarter firewall guarding it. It's a dying world for Layer 4 firewalls these days
đź‘Ť 1
r
Richard Faulkner
11/25/2024, 8:19 PMYou can use the Webroot to drop known bad IP addresses as well as use the built-in firewall settings for the Gateway to limit and protect the Gateway. Julian wrote up a good blog about it here once it became available. https://www.julianjakob.com/netscaler-waf-for-gateway-and-aaa/
đź‘Ť 1
n
Neal Dolson
11/25/2024, 10:56 PMI watched an overview of that new functionality in a recorded Zoom that Citrix hosted - I'm admittedly not a WAF expert in general, but my take away is this capability wouldn't really impact the ability to submit credentials to the gateway login page, like a password spray? The demo they performed was basically an invalid get request or something.
r
Richard Faulkner
11/26/2024, 1:49 PMA password spray would be stopped using two capabilities. Bot detection would presumably catch when it is not a human entering the credentials and if not, rate limiting (more than one login attempt per second let’s say) would drop the rest.
âś… 1
đź‘Ť 1
a
Alexander Faller
11/27/2024, 7:44 AMWe use the “IP Reputation” feature on our Netscalers.
The “IP Reputation” function already blocks many requests.
It works very well, but sometimes it happens that a public IP that is classified as malicious on abuseipdb is not blocked because the IP is not marked as malicious on the website used by Citrix (Brightcloud).