During one of my Citrix ADC projects, I came across a strange problem. I had to give external users access to a certain IoT device. These very devices don’t support static addressing (!) and are well known for being exploitable, however, there is no really secure alternative available on the market. Because of this, my customer wanted to restrict these crappy devices to a certain range of...
last update: May 6th 2021 I recently moved my blog to a new host, so several objects don’t exist anymore. Unfortunately, this will lead to plenty of 404 not found, instead of giving users access to the website as a whole. So I decided to replace all not found with redirects to a certain page, it might be any kind of sorry page or the default page. It’s up to you. The problem Changing...
Or: Admin partitions Update, March 2021: It does not work with current versions This is a workaround for a well-known problem in NetScaler: Binding NetScaler Gateways to content switching vServers. This solution does not follow Citrix best practices. Avoid using it, if you can! My solution will work with NetScaler 11.1 upward. The Problem Up to 11.0, it was impossible to bind a NetSaler Gateway...
Thinking back to the end of my UNIX days, there had been something called SSH. It had been a replacement for telnet and had a nice feature called SSH keys. SSH keys were a safe and easy way to replace those tiresome passwords. I loved them! Almost at the same time, Windows came up and I lost contact with UNIX. I always hoped, IT will switch over to Linux, but it never happened and my UNIX...
This is an old problem with Citrix ADC / NetScaler: You should test all changes in test-site first and move them to production, or synchronise production site and disaster recovery site. Unfortunately, there is no built-in mechanism to synchronize configuration. So, over time, these sites will start differing, a very unwelcome state. This is especially true for WAF, as applications tend to change...
I am a big fan of cheating if it comes to security. Giving wrong answers to questions may be misleading and will direct attackers into the wrong direction. This will cost time and, at the same time, rise the risk of being caught red-handed. If someone attacks a website, he has to be discrete and fast. Discrete to not get trapped, quick to be long gone in case the owner learns about the attack. So...
This is Corona time, and Corona drives virtualization like nothing else did before. I recently had to fix issues with remote access. Usually, it would have to handle round about 1,500 users, but now, the number of users increased to 15,00, so ten times as much. The existing MPX-11500 could not handle all these connections, latency was way to high. Our customer needed a quick resolution, as every...
Last update: May 8th 2023 There are several use cases for geo-location information in Citrix ADC / NetScaler. It may be helpful with WAF logs. I am European, I won’t spend much time on a positive, if the log comes from North Korea, but I would consider it to be a “false positive”, if it comes from Germany, Italy or Sweden. Even though I would not consider it to be secure...
© Wikipedia, Creufop There seems to be no way to log events inside partitions, even though there are settings for logging and configuration seems to be right. They are exactly the same as in default partition. Syslog server is 127.0.0.1, so the local machine. Everything seems to be perfect. But /var/partitions/<partitionname>/log will remain empty. Why? Well, the syslog-server is 127.0.0.1...
last update: May 5th 2020 Almost two years ago I created a test website for Citrix NetScaler. The product is now called Citrix ADC. It had been a set of files, both, for both, Linux and Windows. It allowed you to create a test environment to test load-balancing solutions, content switching and more. My test web page is very similar to the pages, Citrix Educations use in CNS-220 and the first 3...