Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configuring a Rewrite Policy

September 14, 2021
Contributed by: 
S S

After you create any needed rewrite action, you must create at least one rewrite policy to select the requests that you want the Citrix ADC appliance to rewrite.

A rewrite policy consists of a rule, which itself consists of one or more expressions. And an associated action that is done if a request or response matches the rule. Policy rules for evaluating HTTP requests and responses can be based on almost any part of a request or response.

You can’t use TCP rewrite actions to rewrite data other than the TCP payload. You can base the policy rules for TCP rewrite policies on the information in the transport layer. And the layers below the transport layer.

If a configured rule matches a request or response, the corresponding policy is triggered and the action associated is carried out.

Note: You can use either the command line interface or the configuration utility to create and configure rewrite policies. Users who are not thoroughly familiar with the command line interface and the Citrix ADC Policy expression language will usually find using the configuration utility much easier.

To add a new rewrite policy by using the command line interface

At the command prompt, type the following commands to add a new rewrite policy and verify the configuration:

  • <add rewrite policy <name> <expression> <action> [<undefaction>]
  • <show rewrite policy <name>

Example 1. Rewriting HTTP Content:


> add rewrite policy policyNew "HTTP.RES.IS_VALID" insertact NOREWRITE
 Done
> show rewrite policy policyNew
        Name: policyNew
        Rule: HTTP.RES.IS_VALID
        RewriteAction: insertact
        UndefAction: NOREWRITE
        Hits: 0
        Undef Hits: 0

 Done
<!--NeedCopy-->

Example 2. Rewriting a TCP Payload (TCP Rewrite):

> add rewrite policy client_tcp_payload_policy CLIENT.IP.SRC.EQ(172.168.12.232) client_tcp_payload_replace_all
 Done
> show rewrite policy client_tcp_payload_policy
        Name: client_tcp_payload_policy
        Rule: CLIENT.IP.SRC.EQ(172.168.12.232)
        RewriteAction: client_tcp_payload_replace_all
        UndefAction: Use Global
        LogAction: Use Global
        Hits: 0
        Undef Hits: 0

 Done
>
<!--NeedCopy-->

To modify an existing rewrite policy by using the command line interface

At the command prompt, type the following commands to modify an existing rewrite policy and verify the configuration:

  • <set rewrite policy <name>-rule <expression-action <action> [<undefaction>]
  • <show rewrite policy <name>

Example:


> set rewrite policy policyNew -rule "HTTP.RES.IS_VALID" -action insertaction
 Done

> show rewrite policy policyNew
        Name: policyNew
        Rule: HTTP.RES.IS_VALID
        RewriteAction: insertaction
        UndefAction: NOREWRITE
        Hits: 0
        Undef Hits: 0

 Done
<!--NeedCopy-->

To remove a rewrite policy by using the command line interface

At the command prompt, type the following command to remove a rewrite policy:

rm rewrite policy <name>

Example:


> rm rewrite policy policyNew
Done
<!--NeedCopy-->

To configure a rewrite policy by using the configuration utility

  1. Navigate to AppExpert > Rewrite > Policies.
  2. In the details pane, do one of the following:
    • To create a policy, click Add.
    • To modify an existing policy, select the policy, and then click Open.
  3. Click Create or OK. A message appears in the status bar, stating that the Policy has been configured successfully.
  4. Repeat steps 2 through 4 to create or modify as many rewrite actions as you want.
  5. Click Close. To delete a rewrite policy, select the rewrite policy you want to delete, then click Remove and, when prompted, confirm your choice by clicking OK.

Create rewrite policy for content security headers, XSS protection, HSTS, X-Content-Type-Options, and Content-Security-Policy

At the command prompt, type the following rewrite action commands to add Security header to webpages served through NetScaler using rewrites.

add rewrite action insert_STS_header insert_http_header Strict-Transport-Security "\"max-age=157680000\""
add rewrite action rw_act_insert_XSS_header insert_http_header X-Xss-Protection "\"1; mode=block\""
add rewrite action rw_act_insert_Xcontent_header insert_http_header X-Content-Type-Options "\"nosniff\""
add rewrite action rw_act_insert_Content_security_policy insert_http_header Content-Security-Policy "\"default-src \'self\' ; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' ; style-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; img-src \'self\' data:\""
<!--NeedCopy-->

At the command prompt, type the following rewrite policy commands to add Security header to webpages served through NetScaler using rewrites.

add rewrite policy enforce_STS true insert_STS_header
add rewrite policy rw_pol_insert_XSS_header "HTTP.RES.HEADER("X-Xss-Protection").EXISTS.NOT" rw_act_insert_XSS_header
add rewrite policy rw_pol_insert_XContent TRUE rw_act_insert_Xcontent_header
add rewrite policy rw_pol_insert_Content_security_policy TRUE rw_act_insert_Content_security_policy
<!--NeedCopy-->

At the command prompt, type the following commands to bind policies to virtual server on Response using Goto Expression NEXT.

bind vpn vserver access -policy enforce_STS -priority 100 -gotoPriorityExpression NEXT -type RESPONSE
bind vpn vserver "VSERVERNAME" -policy rw_pol_insert_XSS_header -priority 110 -gotoPriorityExpression NEXT -type RESPONSE
bind vpn vserver access -policy rw_pol_insert_XContent -priority 120 -gotoPriorityExpression NEXT -type RESPONSE
bind vpn vserver access -policy rw_pol_insert_Content_security_policy -priority 130 -gotoPriorityExpression NEXT -type RESPONSE
<!--NeedCopy-->

Configure rewrite policy for content security headers, XSS protection, HSTS, X-Content-Type-Options, and Content-Security-Policy using configuration utility

  1. Navigate to AppExpert > Rewrite > Actions
  2. Click Add to create rewrite actions for each one of the headers.
  3. Navigate to AppExpert > Rewrite > Policies
  4. Click Add to create rewrite policies and link them to actions.
  5. Bind policies to virtual server on Response using the Goto Expression NEXT.

Note: In SSLVPN, we need to use the below Content-Security Action:

add rewrite action Rewrite_Insert_Content-Security-Policy insert_http_header Content-Security-Policy "\"default-src \'self\' ; script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' ; style-src \'self\' \'unsafe-inline\' \'unsafe-eval\'; img-src \'self\' http://localhost:* data:;\"
<!--NeedCopy-->

The localhost exception is required because the browser passes the cookie/GW information to the plug-in using localhost HTTP call. Since the CSP had only “self”, only calls to the virtual server would be allowed.

Configuring a Rewrite Policy
September 14, 2021
Contributed by: 
S S
September 14, 2021
Contributed by: 
S S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.