https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-netscaler
s
This message was deleted.
m
m
Hi Kari, I've done it with Patsets before, this is some outdated IPs, but it does show different subnets. It will look messy in the Policy Expression, but very clear on the service where it's needed. First create a patternset and bind some IPs 
bind policy patset PS_Exchange_Online "13.107.6.152/31" -index 1
bind policy patset PS_Exchange_Online "13.107.9.152/31" -index 2
bind policy patset PS_Exchange_Online "13.107.18.10/31" -index 3
bind policy patset PS_Exchange_Online "13.107.19.10/31 " -index 4
bind policy patset PS_Exchange_Online "13.107.128.0/22" -index 5
bind policy patset PS_Exchange_Online "23.103.160.0/20" -index 6
bind policy patset PS_Exchange_Online "23.103.224.0/19" -index 7
bind policy patset PS_Exchange_Online "10.195.126.0/24" -index 8
bind policy patset PS_Exchange_Online "40.96.0.0/13" -index 9
bind policy patset PS_Exchange_Online "40.104.0.0/15" -index 10
bind policy patset PS_Exchange_Online "52.96.0.0/14" -index 11
bind policy patset PS_Exchange_Online "111.221.112.0/21" -index 12
bind policy patset PS_Exchange_Online "131.253.33.215/32" -index 13
bind policy patset PS_Exchange_Online "132.245.0.0/16" -index 14
bind policy patset PS_Exchange_Online "134.170.68.0/23" -index 15
bind policy patset PS_Exchange_Online "150.171.32.0/22" -index 16
bind policy patset PS_Exchange_Online "157.56.232.0/21" -index 17
bind policy patset PS_Exchange_Online "157.56.240.0/20" -index 18
bind policy patset PS_Exchange_Online "1191.232.96.0/19" -index 21
bind policy patset PS_Exchange_Online "191.234.6.152/32" -index 22
bind policy patset PS_Exchange_Online "191.234.140.0/22" -index 23
bind policy patset PS_Exchange_Online "204.79.197.215/32" -index 24
bind policy patset PS_Exchange_Online "206.191.224.0/19" -index 25
bind policy patset PS_Exchange_Online "192.168.0.6/32" -index 26
Next create a policy expression that looks into that pattern set, so when you need to use the expression it's just PE_Exchange_Online or whatever you name it. 
add policy expression PE_Exchange_Online "(CLIENT.IP.SRC+\"/32\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(24)+\"/24\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(31)+\"/31\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(22)+\"/22\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(20)+\"/20\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(19)+\"/19\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(15)+\"/15\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(14)+\"/14\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(16)+\"/16\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(21)+\"/21\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(23)+\"/23\").EQUALS_ANY(\"PS_Exchange_Online\" ) || (CLIENT.IP.SRC.SUBNET(13)+\"/13\" ).EQUALS_ANY(\"PS_Exchange_Online\")"
k
thank you... so I need to include all possible subnet masks that are included with my expression? I'll give this a try
m
yes correct. or you can simply create the expression containing all possible subnet masks and ignore it because you "filter" using your pattern set entries.
k
doesn't work
I would need the policy to hit for the listed subnets and if it doesn't, go to next one in cascade
so if I would create a patternset as follows: 
add policy patset pat_set_internal
bind policy patset pat_set_internal "192.168.0.0/16" -index 3
bind policy patset pat_set_internal "172.16.0.0/12" -index 2
bind policy patset pat_set_internal "10.0.0.0/8" -index 1
... and then an expression: 
add policy expression expr_clientip_internal " (CLIENT.IP.SRC.SUBNET(8)+\"/8\").EQUALS_ANY(\"pat_set_internal\" ) || (CLIENT.IP.SRC.SUBNET(12)+\"/12\").EQUALS_ANY(\"pat_set_internal\" ) || (CLIENT.IP.SRC.SUBNET(16)+\"/16\").EQUALS_ANY(\"pat_set_internal\" )
and then I use this expression to the negotiate policy (aiming that only IPs from those source subnets would hit), it doesn't seem to work
@Martin Meier I already did try using the "plain" expression directly to the policy, but that didn't seem to work either, it's a bit of a mystery 😄
m
Yes, but you're missing a " in the policy expression, when you bind it on the ADC it's just expr_clientip_internal So 
add policy expression expr_clientip_internal "(CLIENT.IP.SRC.SUBNET(8)+\"/8\").EQUALS_ANY(\"pat_set_internal\" ) || (CLIENT.IP.SRC.SUBNET(12)+\"/12\").EQUALS_ANY(\"pat_set_internal\" ) || (CLIENT.IP.SRC.SUBNET(16)+\"/16\").EQUALS_ANY(\"pat_set_internal\")"
You can even see it under the expression in the GUI. When you're saying it's not working, is it because the expression doesn't get hit or?
Open in Slack
PreviousNext
Powered by