World of EUC

image.png

So the 'WAF' feature on AAA and GW VIPs is a total dud? Wish they can enable us to configure them same as the WAF for LB VIPs?

It wasn't an ability that they possessed before. Remember, Citrix Gateway ash shoehorned in to an existing product at first, so it doesn't cooperate the same way as Responder or PBR etc. For VPN and Gateway, I would submit that Citrix NetScaler would be the best to know if an activity was expected or not on the gateway and block it.

Also, don't confuse this WAF portion with for example the IP Reputation capability I am recommending all gateway and AAA users enable. It is bound separately and can be (and I recommend is) bound globally. Similar policies with BOT management. WAF takes a lot of trial and error to get set right, so I prefer that NetScaler sets those on Gateway since they know the product better that I do.