Does anyone use any reputation blacklists for netscaler to block IPs? Still seeing good amount of activity. Do you guys just block stuff at perimeter instead?

Our FW is doing this job, if not I would enable it.

I read that is is possible to do but not sure how it works in real life in terms of load on NS and false positives...

Based on the community feedback, it seems to do a good job.

There was a CTX article that went over the config over the weekend but I can't find it right now. Anyone have that? I think there is a piece on the cloud side and actual config on the netscalers

There you go, an easy example for a responder policy, using IP-Reputation DB. No need on the Cloud-side, just let NSIP's access some URL's via 443 outbound to Brightcloud Domains - and the need of premium License on NetScaler. Also with a Blacklist (for fast manual blocking of IP's) and a Whitelist, if there is a false-positive (very rare in the wild)

####Enable and Bind IP Reputation to block public malicious IP Addresses
####All NS Nodes (NSIP) has to be access to api.bcti.brightcloud.com with 443 to get the IP Database
####for no issues set these URL's for outbound access, too:
localdb-ip-daily.brightcloud.com
localdb-ip-rtu.brightcloud.com
api.bcti.brightcloud.com
localdb-ipv6-daily.brightcloud.com
ipce-daily.brightcloud.com
ipce-rtu.brightcloud.com
####Enabling Logging and Creatin a Whitelist DB for acting against false-positives
#### <https://docs.netscaler.com/en-us/citrix-adc/current-release/reputation/ip-reputation.html>

set audit syslogParams -userDefinedAuditlog YES
set audit nslogParams -userDefinedAuditlog YES

add policy dataset PatSet_IP_Whitelist ipv4

add policy dataset PatSet_IP_Blacklist ipv4

enable feature reputation

add audit messageaction IPREP_OR_BLOCKLIST WARNING "CLIENT.IP.SRC + \" was dropped because they are listed in either the IPREP Database or on the NetScaler Blacklist PatternSet\"" -logtoNewnslog YES

add responder policy RespPol_Drop_MaliciousIP "(CLIENT.IP.SRC.IPREP_IS_MALICIOUS||CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"PatSet_IP_Blacklist\"))&&CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(\"PatSet_IP_Whitelist\").NOT" DROP -logAction IPREP_OR_BLOCKLIST


bind vpn vserver <vservername> -policy RespPol_Drop_MaliciousIP -priority 3 -gotoPriorityExpression END -type AAA_REQUEST

savec

The scripts from Gotham and TPop I beleive create the ACLs you can add to your instances and apply. There is also the IP Reputation feature that everyone is now licensed for and can be enabled globally to drop traffic from known bad IP addresses. I am fairly certain the threat actors that were busy the last two weeks were already blocked in the Webroot database. docs.netscaler.com/us/en/…/ip-reputation.html

Is that IP reputation feature used fairly broadly?

Yes. We are recommending all customers enable it if they can. Your NetScalers will need to be able to download the Webroot database from them so they will need internet access or a configured proxy.

Thanks @Richard Faulkner I will bring this up. Anything I need to know about it? Considerations?

It downloads every 15 minutes Test if you can before deployment (as you always should) I usually bind it globally and drop the "IS_MALICIOUS" traffic.

julian I tried your responder policy on one of our test sites and it saw some issues. ICA policies would download but nothing would open. Or we would get gateway_sta_lookup failed. Once I unbound, they went away

Thats very interesting, and the responder policy is getting hits during your issues? I have exactly that IP-Reputation config above implemented and live on about 30 different environments, all working fine and doing its job

doesn't show any hits but the issue definitely went away.

@Julian Jakob @Richard Faulkner do you all see the DB only updating on the primary node in a HA pair? It's what I'm seeing. Does this mean the DB will be outdated after fail over until the next scheduled update?

I think a failover triggers an update if I am remembering correctly. DB cannot be replicated easily I beleive was the issue.