NetScaler® Gateway security recommendations

Last published : Sep 30, 2026
Related information
Other features

Use a 'Default Deny' policy

We recommend that administrators configure the NetScaler Gateway with a 'deny all' policy at the global level, in addition to the use of authorization policies to selectively enable the access to resources on a group basis.
By default, the defaultAuthorizationAction parameter is set to DENY. Verify this setting and grant explicit access to each user. You can use the show vpn parameter command on the CLI to verify the setting. To set the parameter to deny all resources at the global level, run the following command from the CLI:
set vpn parameter -defaultAuthorizationAction DENY

Use TLS1.2 communication between servers

We recommend that TLS1.2 or TLS 1.3 be used for the links between NetScaler Gateway and other services, such as LDAP and Web Interface servers. The use of older versions of this protocol, TLS 1.1, TLS 1.0, and SSLv3 and earlier is not recommended.

Use intranet applications

Use the Intranet Applications feature to define which networks are intercepted by the NetScaler Gateway plug-in and sent to the gateway. The following is a sample set of commands to define interception:
add vpn intranetApplication intra1 ANY 10.217.0.0 -netmask 255.255.0.0 -destPort 1-65535 -interception TRANSPARENT

bind vpn vserver v1 –intranetapp intra1

Authentication, authorization, and auditing security recommendations

If a NetScaler or a NetScaler Gateway appliance is configured as SAML SP or SAML IdP or both, see the article <https://support.citrix.com/article/CTX316577> for recommended configuration details.
For details about SAML authentication, see SAML authentication.

SAML Reject Unsigned Assertion

When configuring NetScaler as a SAML Service Provider (SP), ensure that the Reject Unsigned Assertions parameter in the SAML action is set to either ON or Strict.
  • ON (default): Rejects assertions without a signature.
  • STRICT: Ensures that both the SAML response and the assertion are signed.
Recommendation: Use STRICT.
Note:
  • If your SAML IdP supports signing both SAML assertion and SAML response, then go with the STRICT.
  • Use ON as the minimum acceptable setting.
Use the following command to check the Reject unsigned assertion value in SAML action:
show samlaction <SAML Action Name> | grep 'Reject unsigned assertion'
Reject unsigned assertion: ON
Example configuration:
set samlAction <SAML Action Name> -samlRejectUnsignedAssertion <STRICT | ON>

Enable encryption of NetScaler Gateway login information for nFactor authentication

A NetScaler Gateway appliance with nFactor authentication can encrypt the login request fields submitted by a client (browser or SSO apps) during the authentication process. The encrypted login request fields provide an extra layer of security to protect the user’s sensitive data from being disclosed.
To enable the login encryption by using the CLI, run the following command.
set aaa parameter [-loginEncryption (ENABLED | DISABLED)]
To enable the login encryption by using the GUI
  1. Navigate to Security > AAA – Application Traffic.
  2. Click Change authentication AAA settings under the Authentication Settings section.
  3. On the Configure AAA Parameter page, in Login Encryption click Enabled.
For more details on login encryption, see Encryption of NetScaler Gateway login information for nFactor authentication.

Protect authentication, authorization, and auditing VPN virtual server and NetScaler Gateway

We recommend the following mitigations to protect authentication, authorization, and auditing VPN virtual server and NetScaler Gateway:
  1. Ensure that multifactor authentication is enabled for NetScaler Gateway and the multifactor authentication verification factor is before LDAP factor. For more information, see Configure Multifactor authentication.
  2. Create a responder policy to allow requests only for desired FQDN as some of the attacks seem to be triggered for NetScaler Gateway IP address and not FQDN.
    add responder policy IP_Block "HTTP.REQ.HOSTNAME.EQ(\"<enter gateway FQDN here>\").NOT" DROP

    bind vpn vserver <vserver name> -policy IP_Block -priority 100 -type REQUEST
  3. Enable IP reputation. Enabling IP reputation helps in dropping requests from known malicious IP addresses and reducing the impact of attacks. Run the following commands to enable IP reputation:
    enable feature reputation

    add responder policy policy_brute_block_ip "CLIENT.IP.SRC.IPREP_IS_MALICIOUS" DROP

    bind vpn vserver <Gateway_vserver_name> -policy policy_brute_block_ip -priority 50 -gotoPriorityExpression END -type AAA_REQUEST
    For more information on how to configure IP reputation, see IP Reputation.
  4. Enable recaptcha on NetScaler. For information on how to configure recaptcha, see reCaptcha configuration for nFactor authentication.

Configure split DNS value as REMOTE

We recommend you to configure the DNS resolution as REMOTE.
You can configure DNS resolution by using any one of the following methods:
  1. set vpn parameter splitDns REMOTE
  2. set vpn sessionAction <action-name> splitDns REMOTE
Configuring splitDns at sessionAction is optional. If splitDns is not provided at sessionAction then gateway takes splitDns value from vpn parameter configuration.
If splitDns is configured at sessionAction then the sessionAction configuration takes the precedence over the vpn parameter configuration.
By default, the CLI sets vpn parameter splitDns to BOTH. We recommend you to configure this value as REMOTE.