NetScaler secure deployment guide

Securing the pass-through traffic on NetScaler

September 20, 2024

Contributed by:

Infrastructure mode settings can be used to secure the pass-through traffic on NetScaler. These infrastructure mode settings provide a basic level of security without breaking any applications. The following list summarizes the available infrastructure mode settings.

Session state protection
Session fixation protection (enable HTTP Only)
HSTS (enable HTTP Strict Transport Security (HSTS))
Strong authentication
End-to-end SSL preferred
Proxy HTTPS / Deny all other traffic

Session state protection:

Recommendation: Enabled NetScaler: Enabled by default for most entities

The Session state protection setting is enabled by default and requires no specific configuration. When NetScaler is configured to proxy a connection. For example, when the flow selects a configured virtual server or service of type TCP or above, NetScaler creates a stateful session. NetScaler continues to maintain the state of these connections and only packets that fall in to this state machine are processed. Other packets are either dropped or reset.

The following service-type entities achieve this stateful behavior on NetScaler.

ADNS_TCP
DIAMETER, DNS_TCP
FTP-c
GRE-c
HTTP
MYSQL, MSSQL
NNTP
ORACLE
PUSH, PPTP
RTSP, RDP
SIP_SSL, SIP_TCP
SMPP
SSL, SSL_BRIDGE, SSL_DIAMETER, SSL_PUSH
SSL_TCP, SYSLOG_TCP
TCP
ADNS_TCP
RNAT (rnat_tcpproxy is ENABLED)

Session fixation protection (by enabling the HttpOnly flag or by adding a rewrite policy):

Recommendation: To enable HttpOnly for cookies set by NetScaler or back-end server
NetScaler: Enabled by Default for the NetScaler inserted cookies, possible via Rewrite for cookies set by the back-end server.

HttpOnly: When you tag a cookie with the HttpOnly flag, it indicates to the browser that this cookie must be accessed only by the server. Any attempt to access the cookie from the client script is strictly forbidden. HttpOnly cookies, if properly implemented, makes huge classes of common cross-site scripting attacks much harder to pull off.

The following is an example of a cookie with the HttpOnly flag set:

Set-Cookie: ASP.NET_SessionId=ig2fac55; path=/; HttpOnly
<!--NeedCopy-->

The cookies inserted by NetScaler for Cookie Insert persistence, by default, set the HttpOnly flag to indicate that the cookie is nonscriptable and must not be revealed to the client application. Therefore, a client-side script cannot access the cookie, and the client is not susceptible to cross-site scripting.

To enable the HttpOnly flag setting by using the command line interface:

At the command prompt, type:

set lb parameter -HttpOnlyCookieFlag (ENABLED)  
<!--NeedCopy-->

Using rewrite policy to insert Secure and HttpOnly for cookies:

The rewrite policy inserts Secure and HTTP only for cookies sent by the back-end server.

Note: Secure and HttpOnly cookies together can be done for SSL VIPs. For non-SSL VIPs one can insert the HttpOnly flag.

With NetScaler, one can include HTTP only and Secure flags for cookies set by the server.

HttpOnly - This option on a cookie causes the web browsers to return the cookie using the HTTP (or HTTPS) protocol only; the non-HTTP methods such as JavaScript document.cookie references cannot access the Cookie. This option helps in preventing Cookie theft due to cross-site scripting.
Secure - This option on a cookie causes the web browsers to return only the cookie value when the transmission is encrypted by SSL. This option can be used to prevent cookie theft through connection eavesdropping.

Create a rewrite policy by using the CLI

Enable the Rewrite feature, if not already enabled.
```
enable feature REWRITE

```

Create a rewrite action (this example is configured to set both Secure and HttpOnly flags. If either one is missing, modify it as necessary for other combinations).

add rewrite action <action name> replace_all http.RES.full_Header "\"path=/; Secure; HttpOnly\"" -search "regex(re!(path=/\\; Secure; HttpOnly)|(path=/\\; Secure)|(path=/\\; HttpOnly)|(path=/)!)" -bypassSafetyCheck YES
<!--NeedCopy-->

Example:

add rewrite action act_cookie_Secure replace_all http.RES.full_Header "\"path=/; Secure; HttpOnly\"" -search "regex(re!(path=/\\; Secure; HttpOnly)|(path=/\\; Secure)|(path=/\\; HttpOnly)|(path=/)!)"

or

add rewrite action act_cookie_Secure replace_all http.RES.full_Header "\"path=/; Secure; HttpOnly\"" -search "regex(re!(path=/\\; Secure; HttpOnly)|(path=/\\; Secure)|(path=/\\; HttpOnly)|(path=/)!)" -bypassSafetyCheck YES
<!--NeedCopy-->

Note:

Starting from NetScaler release 13.1, the bypassSafetyCheck parameter is not applicable. However, for releases before 13.1, this parameter is supported.

Create a rewrite policy to trigger the action.

add rewrite policy <policy name> "http.RES.HEADER(\"Set-Cookie\").EXISTS" <action name>
<!--NeedCopy-->

Example:

add rewrite policy rw_force_secure_cookie "http.RES.HEADER(\"Set-Cookie\").EXISTS" act_cookie_Secure
<!--NeedCopy-->

Bind the rewrite policy to the virtual server to be secured (if the Secure option is used, an SSL virtual server must be used).

bind lb vserver <vserver name> - <policy name> -priority <priority number> -gotoPriorityExpression NEXT -type RESPONSE
<!--NeedCopy-->

Example:

bind lb vserver mySSLVServer -policyName rw_force_secure_cookie -priority 100 -gotoPriorityExpression NEXT -type RESPONSE
<!--NeedCopy-->

For more information, see https://support.citrix.com/article/CTX138055.

HSTS (enable HTTP Strict Transport Security (HSTS)):

To enable HSTS by using the NetScaler command line:

At the command prompt, type:

set ssl vserver <vServerName> -HSTS ( ENABLED ) maxage <positive_integer> -IncludeSubdomains ( YES | NO)
<!--NeedCopy-->

set ssl profile <name> -HSTS ( ENABLED ) -maxage <positive_integer> -IncludeSubdomains ( YES | NO )
<!--NeedCopy-->

For more information, see the following topics.

Strong authentication:

Strong Authentication (or multifactor authentication – MFA) must be enabled for all access to sensitive data, apps, and administration.

For details on how sensitive apps can be set up for multifactor authentication, see Multi-Factor (nFactor) authentication.

End-to-end SSL preferred:

It is recommended to have SSL both on the front end and back end. Older unsecure protocol versions, such as SSLv3, TLS 1.0, and TLS 1.1 can be disabled on SSL entities. You can only have TLS 1.2 and TLS 1.3 enabled. It can either be done at the SSL entity level or at the profile level and all the SSL entities inherit the SSL settings from the profile.

Disable unsecure and enable secure protocol versions on SSL entities by using the CLI

At the command prompt, type:

set ssl vserver <vServerName> -ssl2 DISABLED   -ssl3  DISABLED   -tls1   DISABLED   -tls11   DISABLED    -tls12   ENABLED    -tls13   ENABLED

set ssl service <vServiceName> -ssl2 DISABLED   -ssl3  DISABLED   -tls1   DISABLED   -tls11   DISABLED    -tls12   ENABLED    -tls13   ENABLED
<!--NeedCopy-->

If SSL profile is enabled, use the following command:

set ssl profile <frontend profile> -ssl3  DISABLED   -tls1   DISABLED  -tls11  DISABLED   -tls12   ENABLED    -tls13   ENABLED

set ssl profile <backend profile> -ssl3  DISABLED   -tls1   DISABLED  -tls11  DISABLED   -tls12   ENABLED    -tls13   ENABLED
<!--NeedCopy-->

**Note:

We recommend enabling TLS 1.3 using the profile instead of enabling it on virtual server entities. For more information, see Support for TLS 1.3 protocol.

NetScaler recommended cipher suites:

The following ciphers supported by NetScaler do not include any components on the “mandatory discard” list. These ciphers are organized by key-exchange (RSA, DHE, and ECDHE) then by placing the higher performing ones at the top with the higher security ones at the bottom:

Recommend RSA Key Exchange Cipher suites:

TLS1-AES-128-CBC-SHA
TLS1-AES-256-CBC-SHA
TLS1.2-AES-128-SHA256
TLS1.2-AES-256-SHA256
TLS1.2-AES128-GCM-SHA256
TLS1.2-AES256-GCM-SHA384

Recommend DHE Key Exchange Cipher suites:

TLS1-DHE-RSA-AES-128-CBC-SHA
TLS1-DHE-RSA-AES-256-CBC-SHA
TLS1.2-DHE-RSA-AES-128-SHA256
TLS1.2-DHE-RSA-AES-256-SHA256
TLS1.2-DHE-RSA-AES128-GCM-SHA256
TLS1.2-DHE-RSA-AES256-GCM-SHA384

Recommend ECDHE Key Exchange Cipher suites:

TLS1-ECDHE-RSA-AES128-SHA
TLS1-ECDHE-RSA-AES256-SHA
TLS1.2-ECDHE-RSA-AES-128-SHA256
TLS1.2-ECDHE-RSA-AES-256-SHA384
TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
TLS1.2-ECDHE-RSA-AES256-GCM-SHA384

Recommend Cipher suites in the order of preference:

The following list of ciphers includes RSA, DHE, and ECDHE key exchanges. It provides the best compromise between security, performance, and compatibility.

TLS1.2-AES128-GCM-SHA256
TLS1.2-AES-128-SHA256
TLS1.2-ECDHE-RSA-AES128-GCM-SHA256
TLS1.2-ECDHE-RSA-AES-128-SHA256
TLS1-ECDHE-RSA-AES128-SHA
TLS1.2-DHE-RSA-AES128-GCM-SHA256
TLS1.2-DHE-RSA-AES-128-SHA256
TLS1-DHE-RSA-AES-128-CBC-SHA
TLS1-AES-128-CBC-SHA

SSL secure profile and secure ciphers:

We recommend that you bind the secure front-end profile (ns_default_ssl_profile_secure_frontend) to your SSL virtual server. A secure cipher alias is added and bound to the secure front-end profile. To list the ciphers that are part of this alias, at the command prompt type:

show cipher SECURE

    1) Cipher Name: TLS1.2-ECDHE-RSA-AES256-GCM-SHA384 Priority : 1
           Description: TLS 1.2 Kx=ECC-DHE  Au=RSA  Enc=AES-GCM(256) Mac=AEAD   HexCode=0xc030
    2) Cipher Name: TLS1.2-ECDHE-RSA-AES128-GCM-SHA256 Priority : 2
           Description: TLS 1.2 Kx=ECC-DHE  Au=RSA  Enc=AES-GCM(128) Mac=AEAD   HexCode=0xc02f
    3) Cipher Name: TLS1.2-ECDHE-ECDSA-AES256-GCM-SHA384            Priority : 3
           Description: TLS 1.2 Kx=ECC-DHE  Au=ECDSA Enc=AES-GCM(256) Mac=AEAD   HexCode=0xc02c
    4) Cipher Name: TLS1.2-ECDHE-ECDSA-AES128-GCM-SHA256            Priority : 4
           Description: TLS 1.2 Kx=ECC-DHE  Au=ECDSA Enc=AES-GCM(128) Mac=AEAD   HexCode=0xc02b
Done
<!--NeedCopy-->

For more information about the secure front-end profile, see Secure front-end profile.

Protocols lower than TLS 1.2 are disabled on the SSL internal services. If the default (enhanced) profile is enabled, then the ns_default_ssl_profile_internal_frontend_service profile is bound to the SSL internal services and SSLv3, TLS 1.0, TLS 1.1, and TLS 1.3 protocols are disabled in the profile.

Proxy HTTPS / deny all other traffic:

Wherever feasible have SSL VIPs for better encryption of data, by using secure SSL versions (TLS 1.2 or TLS 1.3) and secure ciphers. The SSL TPS and SSL throughput must be considered while enabling SSL for the VIPs and back-end SSL services.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Securing the pass-through traffic on NetScaler

September 20, 2024

Contributed by:

September 20, 2024

Contributed by:

Securing the pass-through traffic on NetScaler

In this article