This message was deleted.
# citrix-netscalers
Slackbot
03/11/2021, 8:50 PMThis message was deleted.
n
Neal Dolson
03/11/2021, 8:51 PMA colleague suggested that we could edit the expression used for /EWS (HTTP.REQ.URL.CONTAINS("/ews") and add something like && CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY(%data set name%) so that the only way an EWS request gets sent to the backend LBVIP is by matching both the "/ews" patch and sourcing from the specified IP in the data set
Neal Dolson
03/11/2021, 8:55 PMIt seems like this would work, in that it gives us the net-result of only EWS traffic from a single IP on the public facing context switch is allowed. But I wasn't sure if there was a "cleaner" way to do it than it just not matching a context switch policy.
Neal Dolson
03/11/2021, 8:58 PMI wondered if maybe a responder policy that issues a 403 or 404 if an attempt is made to access EWS from an IP other than the one associated with the 3rd party, or maybe better just a silent drop action, because adding the second condition to the context switching policy just means that it no longer matches that policy and continues on down the list. The traffic isn't really "dealt with" it's just punted on to the next lower priority policy.
l
Leee Jeffries
03/11/2021, 10:26 PMI'd use a responder on the load balanced vip that the content switch is hitting. You can tier them like that.
Leee Jeffries
03/11/2021, 10:29 PMCreate your data set of ips (only 1 as you mentioned) and create a responder policy that only triggers if its not one on those ips
CLIENT.IP.SRC.TYPECAST_TEXT_T.CONTAINS_ANY("data_set").NOT
👍 1