For people experiencing password spray attacks - try attach the following responder policy to your gateway - it should drop invalid requests HTTP.REQ.HOSTNAME.CONTAINS("YOURIP")||HTTP.REQ.HOSTNAME.EQ("YOURGATEWAYFQDN").NOT||(HTTP.REQ.URL.TO_LOWER.EQ("/cgi/login")&&HTTP.REQ.COOKIE.CONTAINS("NSC_TASS=/No%20Page")

^ The above is huge to protect your AD accounts from being locked out by brute force attempts @ the Gateway

That blog is sharing a different policy to use

Setting a responder action with with either a respondwith, or respond_with_web_page using rate limiting; the page or the URL content never loads. I see my responder being hit in statistics but I get a spinning wheel, in both Edge/Chrome. What does work is if I do a drop but would rather really show some html content. Anyone know where else I can look ? I've tried 13.1 and 14.1 latest.

We have the same problem. In BurpSuite you can see the HTML Webpage response but in the browser you see only a spinning wheel

Regarding the spinning wheel, if you follow the Citrix guide and using some MFA solution it will redirect you to "..../cgi/login" when waiting for MFA. This page is dropped in the patset rule.

With nfactor and prompting for username first seems to mitigate the issue. You need to know the username first and also you need to tick EULA.

We were still seeing spray attacks getting through with nfactor and WAF enabled. We dropped in my iprep code to stop them. It's a little more indepth than the Citrix provided, as it has an allow and block list, and drops info to NetScaler console for easy IP tracking. https://www.jeffriechers.com/wiki/easy-ip-reputation-configuration/

Thanks Jeff, we may be just lucky! I'll check out your code and may implement it in case of.