Citrix NetScaler

About the Device

The Citrix® NetScaler® product is an application switch that performs application-specific traffic analysis to intelligently distribute, optimize, and secure Layer 4-Layer 7 (L4-L7) network traffic for web applications. For example, a NetScaler makes load balancing decisions on individual HTTP requests rather than on the basis of long-lived TCP connections, so that the failure or slowdown of a server is managed much more quickly and with less disruption to clients.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

Configuring Citrix NetScaler VPX:

1. Verify if the hostname is configured.

   1. Login to the NetScaler Web interface as an Administrator.

   2. Navigate to Configuration > Settings.

c. Select Host Name, DNS IP Address and Time Zone.

d. In the Host Name text box, verify if the host name is present.

i. If the host name is configured already, no action is required.

ii. If the text box is empty, type a host name without space.

iii. In the DNS IP Address text box, verify if the local DNS IP address is added.

iv. In the Time Zone text box, select GMT.

2. Configure the Syslog server action.

   1. Login to the NetScaler Web interface as an Administrator.

   2. Navigate to Configuration > System > Auditing > Syslog > Servers.

   3. Click Create

   4. Enter the Syslog details

      1. Name - Provide name for syslog configuration

      2. Server Type - Select Server IP

      3. IP address - Provide IP Address of CyberHub

      4. Port - Provide the port number as 514

e. Select Log Levels as Custom.

f. Enable all checkboxes except DEBUG level in the configuration.

g. Select LOCAL0 from Log Facility.

h. Select MMDDYYYY from Date Format drop-down.

i. Select Time Zone as GMT.

j. Uncheck all the check boxes as per below screenshot.

k. Click OK to create the auditing server.

3. Binding the created audit policy to the server.

   1. Go to Configuration > System > Auditing > Syslog and click the Policies tab.

   2. In Name, type a name for the policy.

   3. In Server, select the policy from the previous section and click Create

4. Right-click the created Auditing Policy and navigate to Action > Global Bindings and click Add Binding. 

5. In the Policy Binding window

   1. In Select Policy, type the created audit policy.

   2. In Binding Details, in the Priority text box, type 120 as it is the default priority and click Bind.

Configuring Citrix NetScaler SDX:

1. Verify if the hostname is configured.

   1. Login to the NetScaler Web interface as an Administrator.

   2. Navigate to System > System Settings

   3. In Host Name, verify if the host name is present.

      1. If the host name is configured already, no action is required.

      2. If the text box is empty, type a host name without space.

d. In Time Zone, select UTC/GMT.

2. Configure a syslog server.

   1. Navigate to System > Notifications > Syslog Servers.

   2. In the details pane, click Add.

   3. In the Create Syslog Server, specify values for the syslog server parameters.

      1. Name - Provide name for syslog configuration

      2. IP address - Provide IP Address of CyberHub

      3. Port - Provide the port number as 514

      4. Select Log Levels as Custom.

      5. Enable all checkboxes except DEBUG level in the configuration.

d. Click Create

3. Configure the syslog parameters (date and time format).

   1. Navigate to System > Notifications > Syslog Servers.

   2. In the details pane, click Syslog Parameters.

   3. In the Configure Syslog Parameters, select the date format MMDDYYYY and select time format GMT. Click OK.

Integration Parameters

Parameters required from customer for Integration.