Getting spammed with these alerts with WAF enabled...
# citrix-netscalerc
c4rm0
07/23/2026, 2:49 PMGetting spammed with these alerts with WAF enabled on NS GW (New build auto enabled it) from NS console anyone know how to stop the alerts ? Category : appfwSchemaParameterMissing
Severity : Major
FailureObject : appfirewall
Netscaler Console IP Address : Application Delivery Management
Information : appfwLogMsg : 77.91.71.25 2168284-PPE1 - ns-vpn-default-appfw-profile Schema validation failed as per API Spec: (ns-vpn-spec) for Endpoint: (GET https://87.x.x.x/vpn/index.html) blocked, Entity : 10.129.75.230appfwSchemaParameterMissingappfirewall, Device_family : ns
c4rm0
07/23/2026, 2:54 PMi dont recognize the IP 77.91.71.25 and IP whois shows it as being from Israel so presume its a bot/spammer/scanner browsing the GW page
c4rm0
07/23/2026, 3:31 PMi presume only way to stop it would be to drop the severity below for appfwSchemaParameterMissing or exclude it from the event rule
j
Jeff Riechers
07/23/2026, 4:07 PMIf it is all coming from that source IP I would block it outright.
💯 1
c
c4rm0
07/23/2026, 4:10 PMWAF says it blocked it but keep seeing the same IP so dont think its a full block. Block it at FW level or something like a responder policy ?
j
Jeff Riechers
07/23/2026, 4:12 PMI would do it as a responder policy. I have some code for setting up a dataset for bad IP addresses you can put entries like those into it for blocking. docs.jeffriechers.com/NetScaler/…/easy-ip-reputation-configuration
c
c4rm0
07/23/2026, 4:13 PMcool i used IP reputation before
c4rm0
07/24/2026, 12:25 PMi tried the IP block Drop using a responder policy but WAF is processed before Reposnder so it doesnt apply and still get these alerts
j
Jeff Riechers
07/24/2026, 12:30 PMYeah, the WAF is bound Globally, so you may need to bind the IP Block Drop Globally as well. I think you can Bind it as a WAF policy to get it to interact sooner.
3 Views