Had a large customer of ours saw >21 million failed login attempts on a site in a 14 hour period. Mind you this was a new ICA only site that had no method of actually authenticating on a test site. But, it does show the value of the brute force prevention methods. We already have the change request in to modify the test site.

we had 2.7 million failed login attempts in about the same time period, 2500-2600 attempts per fabricated user, and the users were aimed at the company (current and ex employee names with firstname.lastname that were attempted) For some reason this caused the nsvpn.log file to be unable to rollover and kept growing until /var was full , fun times. Looking at the rate limiting + WAF options now :)

For sure. This is the value of a good L7 firewall at the edge.

Trying to find a netscaler cookie like the NSC_VPNERR that doesn't seem to exist anymore.

@Ryan Gallier NetScaler added that capability on the 13.1 and 14.1 latest builds. You can Layer 7 WAF any AAA and SSL VPN vServer you want.

Oh, for sure, however, you always want to catch that kind of stuff at the closest layer to origin, right? So, the actual Firewall on the edge, should have L7, and block all of that before it even hits the NS, imo... But yes, adding those layers can only help.

I would personally run it on both. Security is like an onion, it has layers.....🤣

for sure

For 13.1 you need build 53+ i think to use the IP Reputation features

Does the WAF work if I’m still using basic policies? I’m guessing AAA wouldn’t work but vpn might?

Does the WAF/Security Insight enablement at the AAA level require the WAF feature to be enabled at the license level? The additional WAF feature set is not available unless we enable the license, correct?

I think most licenses would include that now as part of the new structure