Hi all, I'm attempting to test out some of the password spray/bot mitigation features outlined in this Citrix Blog https://www.citrix.com/blogs/2024/12/13/password-spraying-attacks-netscaler-december-2024/. The portion I'm having a problem with is enabling the WAF on the Gateway by enabling "WAF Protection" for "AUTH and VPN" on the global AAA parameters and then with this command "bind appfw profile ns-aaa-default-appfw-profile -denylist “HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS_ANY(\”patset_block_urls\”)” -valueType Expression -ruleAction log RESET". Pasting that command into the "Command line interface" in the web GUI, it's flagging the "-ruleAction" parameter, and I'm not familiar enough with the WAF side of the NetScaler to know why. Looking through the syntax documentation it looks as though it should work. This NetScaler is running 14.1 38.53.nc - does anyone see anything obviously incorrect with the command in the Citrix Blog?

Try using this:

bind appfw profile ns-aaa-default-appfw-profile -denylist "HTTP.REQ.URL.SET_TEXT_MODE(IGNORECASE).CONTAINS_ANY(\"patset_block_urls\")" -valueType Expression -ruleAction log RESET

Oh, I forgot to press send. Yeah, sometimes it's also because Citrix has spellcheck(or similar) enabled on these blogposts, so sometimes the en dash - turns into a em dash, – or, less often, --.

Thanks all...that reformatted command seems to have done the trick. Good to know about the hard to notice character changes. 👍