Enabling the Application Firewall

NetScaler 11.1

NetScaler Release Notes
Getting Started with Citrix NetScaler
FAQs
Solutions for Telecom Service Providers
NetScaler Solutions
Deploy a Citrix NetScaler VPX instance
Hardware Installation
Licensing
Upgrade and downgrade a NetScaler appliance
AAA application traffic
Admin Partitioning
AppExpert
AppFlow
Application Firewall
Cache Redirection
Clustering
Content Switching
DataStream
Domain Name System
Firewall Load Balancing
Global Server Load Balancing
Link Load Balancing
Load Balancing
Networking
Optimization
Reputation
- IP Reputation
SSL offload and acceleration
Security
System
Reference Material

Product Documentation

NetScaler 11.1

NetScaler Release Notes
Getting Started with Citrix NetScaler
- Where Does a NetScaler Appliance Fit in the Network?
- How a NetScaler Communicates with Clients and Servers
- Introduction to the Citrix NetScaler Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a NetScaler appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
FAQs
- AppFlow
- AutoScale
- Call Home
- Clustering
- Connection Management
- NetScaler GUI
- Content Switching
- Debugging
- High Availability
- Hardware
- Integrated Caching
- Load Balancing
- SDX
- SSL
- Installing, Upgrading, and Downgrading
Solutions for Telecom Service Providers
- Large Scale NAT
- Dual-Stack Lite
- Large Scale NAT64
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- NetScaler TCP Optimization
NetScaler Solutions
- Setting Up NetScaler for XenApp/XenDesktop
- Global Server Load Balancing (GSLB) Powered Zone Preference
- NetScaler in a Private Cloud Managed by Microsoft Windows Azure Pack and Cisco ACI
Deploy a Citrix NetScaler VPX instance
- Support matrix and usage guidelines
- Install a NetScaler VPX instance on XenServer
  - Configuring NetScaler Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interfaces
- Install a NetScaler VPX instance on VMware ESX
- Install a Citrix NetScaler VPX instance on Microsoft Hyper-V servers
- Install a NetScaler VPX instance on Linux-KVM platform
- Deploying NetScaler VPX Instances on AWS
- Deploy a NetScaler VPX instance on Microsoft Azure
- Deploying NetScaler VPX Instances on Oracle Public Cloud
- Deploying a NetScaler VPX Instance on Cisco CSP 2100
- Configuring the Basic System Settings
- Jumbo frames on NetScaler VPX instances
Hardware Installation
Licensing
- NetScaler licensing overview
- NetScaler Gateway Universal License
- NetScaler Pooled Capacity
Upgrade and downgrade a NetScaler appliance
AAA application traffic
- How AAA works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring AAA policies
  - Authentication policies
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
  - Client certificate pass-through
- Configuring AAA with commonly used protocols
  - Handling authentication, authorization and auditing with Kerberos/NTLM
- NetScaler Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
Admin Partitioning
- Supported NetScaler configurations
- Configure admin partitions
- SNMP support for admin partitions
AppExpert
- Action Analytics
- AppExpert Applications and Templates
- AppQoE
- Entity Templates
- HTTP Callouts
- Pattern Sets and Data Sets
- Variables
- Policies and Expressions
- Rate Limiting
- Responder
- Rewrite
- String Maps
- URL Sets
AppFlow
- Configuring the AppFlow Feature
- Exporting Performance Data of Web Pages to AppFlow Collector
- Session Reliability on NetScaler High Availability Pair
Application Firewall
- FAQs and Deployment Guide
- Introduction
  - Web Application Security
  - How The Application Firewall Works
  - The Application Firewall Configuration Interfaces
- Configuring the Application Firewall
  - Enabling the Application Firewall
  - The Application Firewall Wizard
  - Manual Configuration
  - Manual Configuration By Using the Configuration Utility
  - Manual Configuration By Using the Command Line Interface
- Signatures
  - Manually Configuring the Signatures Feature
  - Adding or Removing a Signatures Object
  - Configuring or Modifying a Signatures Object
  - Protecting JSON Applications using Signatures
  - Updating a Signatures Object
  - Exporting a Signatures Object to a File
  - The Signatures Editor
  - Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
  - HTML Cross-Site Scripting Check
  - HTML SQL Injection Checks
  - Buffer Overflow Check
  - Cookie Consistency Check
  - Application Firewall Support for Google Web Toolkit
- Data Leak Prevention Checks
  - Credit Card Check
  - Safe Object Check
- Advanced Form Protection Checks
  - Field Formats Check
  - Form Field Consistency Check
  - CSRF Form Tagging Check
  - Managing CSRF Form Tagging Check Relaxations
- URL Protection Checks
  - Start URL Check
  - Deny URL Check
- XML Protection Checks
  - XML Format Check
  - XML Denial-of-Service Check
  - XML Cross-Site Scripting Check
  - XML SQL Injection Check
  - XML Attachment Check
  - Web Services Interoperability Check
  - XML Message Validation Check
  - XML SOAP Fault Filtering Check
- Managing Content Types
- Profiles
  - Creating Application Firewall Profiles
  - Configuring Application Firewall Profiles
  - Changing an Application Firewall Profile Type
  - Exporting and Importing an Application Firewall Profile
  - Configuring and Using the Learning Feature
  - Supplemental Information about Profiles
- Policy Labels
- Policies
  - Firewall Policies
  - Auditing Policies
- Imports
  - Importing and Exporting Files
- Global Configuration
  - Engine Settings
  - Confidential Fields
  - Field Types
  - XML Content Types
  - JSON Content Types
- Statistics and Reports
- Application Firewall Logs
- Appendices
  - PCRE Character Encoding Format
  - Whitehat WASC Signature Types for WAF Use
  - Streaming Support for Request Processing
  - Trace HTML Requests with Security Logs
  - Application Firewall Support for Cluster Configurations
- Debugging and Troubleshooting
  - High CPU
  - Memory
  - Large File Upload Failure
  - Learning
  - Signatures
  - Trace Log
  - Miscellaneous
  - References
Cache Redirection
- Cache redirection policies
  - Built-in cache redirection policies
  - Configure a cache redirection policy
- Cache redirection configurations
- Selective cache redirection
- Administer a cache redirection virtual server
- N-tier cache redirection
  - Configure the upper-tier NetScaler appliances
  - Configure the lower-tier NetScaler appliances
Clustering
- NetScaler configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a NetScaler cluster
- Distributing traffic across cluster nodes
  - Using Equal Cost Multiple Path (ECMP)
  - Using cluster link aggregation
- Managing the NetScaler cluster
- Cluster setup and usage scenarios
- Upgrading or downgrading the NetScaler cluster
- Operations supported on individual cluster nodes
- FAQs
- Troubleshooting the NetScaler cluster
  - Tracing the packets of a NetScaler cluster
  - Troubleshooting common issues
Content Switching
- Configuring Basic Content Switching
- Customizing the Basic Content Switching Configuration
- Content Switching for Diameter Protocol
- Protecting the Content Switching Setup against Failure
- Managing a Content Switching Setup
- Managing Client Connections
- Troubleshooting
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
Domain Name System
- Configure DNS resource records
- Configure a DNS zone
- Configure the NetScaler as an ADNS server
- Configure the NetScaler as a DNS proxy server
- Configure the NetScaler as an end resolver
- Configure the NetScaler as a forwarder
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Domain name system security extensions
Firewall Load Balancing
- Sandwich Environment
- Enterprise Environment
- Multiple-Firewall Environment
Global Server Load Balancing
- How GSLB Works
- GSLB Deployment Types
  - Active-Active Site Deployment
  - Active-Passive Site Deployment
  - Parent-Child Topology Deployment using the MEP Protocol
- GSLB Configuration Entities
- Configuring Global Server Load Balancing (GSLB)
  - Configuring an Authoritative DNS Service
  - Configuring a Basic GSLB Site
  - Configuring a GSLB Service
  - Configuring a GSLB Virtual Server
  - Binding GSLB Services to a GSLB Virtual Server
  - Binding a Domain to a GSLB Virtual Server
  - Synchronizing a Configuration in a GSLB Setup
- Testing the GSLB setup
- Configuring the Metrics Exchange Protocol (MEP)
- Configuring Site-to-Site Communication
- Customizing Your GSLB Configuration
- Changing the GSLB Method
- Configuring Static Proximity
  - Adding a Location File to Create a Static Proximity Database
  - Adding Custom Entries to a Static Proximity Database
  - Setting the Location Qualifiers
  - Specifying the Proximity Method
  - Synchronizing GSLB Static Proximity Database
- Configuring the Dynamic Method (RTT)
- Configuring Persistent Connections
- Overriding Static Proximity Behavior by Configuring Preferred Locations
- Monitoring GSLB Services
- Monitoring GSLB Sites
- Protecting the GSLB Setup Against Failure
- Managing Client Connections
- Configuring GSLB for Disaster Recovery
- Configuring GSLB for Proximity
- Example of a Complete Parent-Child Configuration Using the Metrics Exchange Protocol
- Configuring GSLB Service Selection Using Content Switching
- Configuring Global Server Load Balancing for DNS Queries with NAPTR records
- Using the EDNS0 Client Subnet Option for Global Server Load Balancing
Link Load Balancing
- Configuring a Basic LLB Setup
- Configuring RNAT with LLB