policies aren't getting hit

Would drops show hits?

yes.. @jason : bound as AAA_REQUEST ????

im not seeing any hits

yes bound as AAA

1) Responder Policy Name: pol_samlauth_prefixlist_block Priority: 100 GotoPriority Expression: END Flowtype: AAA_REQUEST We also don't have any hits.

I would make sure that it's the first policy that gets evaluated (e.g. priority 10 )

are you seeing hits @Eric JULIEN

Deployed on three environments, no hits yet (but also no reboot issues, so not targeted atm I think)

No, not yet on first customer I patched, but before starting to patch the first move was to close down access at FW level to all SAML enable endoints until patched and we did not yet reopen. Going to patch the next customer now....

We just had a secondary reboot with the policies in place, bound as AAA_Request.

does this have to go on the AAA Auth profile vservers too?

I did so, Steve, yes. But not sure if it's required, as it's internal redirect to AAA from NSGW.

one question, with the fix in place, should we stop seeing attempts in the log?

I would think so since the responder policy is supposed to drop anything with "pitboss" in the payload.

Hmm thanks Richard.

yet to test the responders, i wonder if the NS is seeing them as AAA request in the 1st place? I have seen threat actors target LB VIPs using URI that are typically behind AAA endpoints... so; worth binding the responders as http request type too and bind to both LB's as well as AAA's?

I would like to understand that could we just unbind the policies... I'm thinking of modifying the SAML one so that if a GW/AAA doesn't use SAML, it would scan for SAML Request/Response in b64 and drop the requests, just in case

did reply to a thread??