Okay for now. What works well when it comes to the SAML issue? There's so much discussion in this channel about this topic. 🙈

Agreed.. Blocking IPs seems to do the trick, I wanted to do it with a dataset but it doesn't seem to work, so the extremely quick and dirty approach I've done so far is add ns acl CVE DENY -srcip 38.134.148.238 add ns acl CVE2 DENY -srcIP 167.148.88.236 add ns acl CVE3 DENY -srcIP 213.209.159.55 apply ns acls But the second they change source IP, the above is outdated. Assume people will read reddit and here, prepare for IP-changes.

Don't want to count chickens just yet, but the most recent policy provided by Citrix Support has stabilised a number of our customers

Stuck in the queue and waiting for hmm, 90 minutes now, let's see what that entails. :p

I just asked them for the mitigation for this issue, and they sent it straight to me without any questions - Security Update: Guidance for NetScaler SAML Authentication Deployments - Security Updates - Citrix Community

Ah, great, thank you. Now to wait for the chance to say just that. :D

If you have the case open already, add a comment asking for this and hopefully they fire it through as soon as they get to your case

Yep, was just about to, good thinking. :D

You guys are talking about the responder policy the provide, or is there sth new? Last night, in all the discussions here, never got a hit on these responder policy and the appliances keep getting targeted and rebooting 😕 but will create a case now also, re-asking if there are any new workarounds to block these attacks. Second best thing is IP-Reputation

We were provided a text file version 2.5 of the policy if that helps - policy is labelled v5c in the config. We are seeing hits on that policy, and the customers we are monitoring haven't had any more crashes since the policy was applied.

Ok that's a new one! thanks for that, Daniel

I would share the policy with the community but it's been made very clear to us it's provided under NDA - and we are a partner so we need to abide by the rules :-/

Perfectly understood, being in the same boat, I know to not even ask. :d

No worries, will ask support for that. Thats fine!

opening a case now to see if they will provide it