Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Retrieve location details from user IP address using geolocation database

August 20, 2024
Contributed by: 
C C S

Note: This feature is available from Citrix ADC release 12.1 build 50.x and later.

The Citrix ADC appliance can now get user location details like continent, county, and city. For any public IP address from a geo location database. This is performed using the advanced policy infrastructure. The retrieved location details are then used in a rewrite action or a responder action for performing the following use cases.

  • Insert an HTTP header with user location details (such as country, city information) when sending the client request to the back-end server.
  • Add country name in the HTML page response for an invalid user.

The appliance can also log the location details using the audit logging mechanism.

Getting user location details using geolocation functions

The components interact as given below:

  1. User sends a client request from a particular geographic location.
  2. The Citrix ADC appliance looks for the user IP address from the client request and retrieves the geo location details (such as continent, country, region, city, ISP, organization, or custom details) from a geolocation database.
  3. Once the location details are retrieved, the appliance uses either a responder policy or a rewrite policy to evaluate the request.
  4. In a rewrite policy, the appliance adds a new header with the geo location details and sends it to the back-end server. For example, insert a custom HTTP header with country information.
  5. In a responder policy, the appliance evaluates the HTTP request and based on policy evaluation, the appliance allows access to the users or redirects the user to an error page stating the region from where they are accessing the application does not have access

Setting up geolocation database

As a pre-requisite, you must have a geolocation database to run on the Citrix ADC appliance. The geolocation database files are available with Citrix ADC firmware. To download the database files from a vendor, convert it into Citrix ADC format and import it into your appliance. For more information about geolocation database, see Add a location file to create static proximity database topic.

Geolocation functions

The following table gives a list of geolocation functions that retrieves location details of any public IP address. These functions can be used in rewrite or responder policies.

Geolocation function Example
CLIENT.IP.SRC.LOCATION Asia.In.Karnataka.Bangalore
CLIENT.IP.SRC.LOCATION.GET (1).LOCATION_LONG India
CLIENT.IP.SRC.LOCATION(3) Asia.In.Karnataka
CLIENT.IP.SRC.LAT_LONG 12,77
CLIENT.IPV6.SRC.LOCATION North America.US.California.Santa Clara.Verizon.Citrix
CLIENT.IPV6.SRC.LOCATION(3) North America.US.California
CLIENT.IPV6.SRC.LOCATION.GET(1).LOCATION_LONG United States
CLIENT.IPV6.SRC.LOCATION.GET(3) California
CLIENT.IPV6.SRC.LAT_LONG 36, -119

Configuring geolocation functions

To configure geolocation functions using advanced policy infrastructure, you must enable the load balancing, rewrite and responder features and then complete the following use cases.

Enable load balancing, responder, rewrite features

If you want Citrix ADC appliance to authorize user access from a particular geo location, you must enable the load balancing, rewrite and responder features.

enable ns feature loadbalancing rewrite responder
<!--NeedCopy-->

Use case 1: Configuring geolocation function for redirecting invalid users outside geo location

When a user from India is requesting access to a webpage, block the request and respond with an HTML page with country name.

Follow the steps given below to complete the configuration for this use case.

  • Add responder action
  • Add responder policy
  • Bind responder policy to load balancing server

For more information about the GUI procedures for rewrite action and rewrite policy configuration, see Responder topic

Add responder action

Add a responder action to respond with HTML page with country name. At the command prompt, type:

add responder action <name> <type> (<target> | <htmlpage>) [-comment <string>] [-responseStatusCode <positive_integer>][-reasonPhrase <string>]
<!--NeedCopy-->

Example:

add responder action responder_act respondwith "CLIENT.REQ.VERSION + \" 304 Requested Page not allowed in your country - \" + CLIENT.IP.SRC.LOCATION.GET (1).LOCATION_LONG + \"\r\n\""
<!--NeedCopy-->

Add auditlog message action

You can configure audit message actions to log messages at various log levels, either in syslog format only or in both syslog and newnslog formats. Audit-message actions use expressions to specify the format of the audit messages. To create an audit message action by using the command line interface

At the command prompt, type: add audit messageaction <name> <logLevel> <stringBuilderExpr> [-logtoNewnslog (YES|NO)] [-bypassSafetyCheck (YES|NO)]

Example:

add audit messageaction msg1 DEBUG "\"Request Location: \"+CLIENT.IP.SRC.LOCATION"
<!--NeedCopy-->

Add responder policy

Add a responder policy to identify requests coming from India and associate the responder action to this policy. At the command prompt, type:

add responder policy <name> <rule> <action> [<undefAction>] [-comment <string>] [-logAction <string>] [-appflowAction <string>]
<!--NeedCopy-->

Example:

add responder policy responder_pol CLIENT.IP.SRC.MATCHES_LOCATION("Asia.India.*.*.*.*") responder_act -logaction  log_act
<!--NeedCopy-->

Bind responder policy to load balancing server

Bind the responder policy to a load balancing virtual server of type HTTP/SSL. At the command prompt, type:

bind lb vserver <vserver name> -policyName < policy_name >  -priority <> -type <L7InlineREQUEST | L4Inline-REQUEST>
<!--NeedCopy-->

Example:

bind lb vserver http_vserver -policyName responder_pol -priority 100 -type REQUEST
<!--NeedCopy-->

Use case 2: Configuring geolocation function for inserting new HTTP header with location details for back-end to respond

Consider a scenario, where a Citrix ADC appliance must insert the user location in HTTP header of a request sent to the application server so that the server can use the information for some business logic. Follow the steps given below to complete the configuration for this use case:

  • Add rewrite action
  • Add rewrite policy
  • Bind rewrite policy to load balancing

For more information about the GUI procedures for rewrite action and rewrite policy configuration, see Responder topic.

Add rewrite action

Add a rewrite action to insert a custom HTTP header with user geolocation details in the request and send it back-end servers. At the command prompt, type:

add rewrite action <name> <type> <target> [<stringBuilderExpr>] [-pattern <expression> | -search <expression>] [-refineSearch <string>][-comment <string>]
<!--NeedCopy-->

Example:

add rewrite action rewrite_act insert_http_header "User_location" CLIENT.IP.SRC.LOCATION
<!--NeedCopy-->

Add rewrite policy

Add a rewrite policy to evaluate if the rewrite action should be executed. In this case, all requests going to the application server must have a custom HTTP header, so the rule can be “true.” At the command prompt, type:

add rewrite policy <name> <rule> <action> [<undefAction>] [-comment <string>] [-logAction <string>]
<!--NeedCopy-->

Example:

add rewrite policy rewrite_pol true rewrite_act -logaction log_act
<!--NeedCopy-->

Bind rewrite policy to load balancing

Bind the rewrite policy to the required load balancing virtual server of type HTTP/SSL. At the command prompt, type:

bind lb vserver <vserver name> -policyName < policy_name >  -priority <> -type <L7InlineREQUEST | L4Inline-REQUEST>
<!--NeedCopy-->

Example:

bind lb vserver http_vserver -policyName rewrite_pol -priority 100 -type REQUEST
<!--NeedCopy-->

Syslog support for logging geolocation details (optional)

If you prefer to log the user’s geolocation details, you must specify the SYSLOG action to be performed when a request matches the policy. The appliance stores the details as a log message in the ns.log file. For more information about SYSLOG and NSLOG auditing, see Audit logging topic.

Output for user geolocation details

If a user is trying to access an application from Bangalore location and if the appliance uses geolocation function, “CLIENT.IP.SRC.LOCATION” then the following output is logged in the appliance using SYSLOG or newnslog action.

Asia.India.Karnataka.Banglore
<!--NeedCopy-->

Sample output log:

07/23/2018:19:03:54 GMT  Debug 0-PPE-0 : default REWRITE Message 22 0 :  "Request Location: asia.in.karnataka.bangalore.*.*"
07/23/2018:19:23:55 GMT  Debug 0-PPE-0 : default RESPONDER Message 32 0
Done
<!--NeedCopy-->
Retrieve location details from user IP address using geolocation database
August 20, 2024
Contributed by: 
C C S
August 20, 2024
Contributed by: 
C C S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.