We want to capture the Netscaler Web Logging Client’s Log files to be able to correlate the real source ip. In these logs – the Internet Source IP are only the Netscaler Subnet IP, not the true source IP. The Citrix Netscaler Web Logging client runs on a Windows Server, where I can use Wincollect to pickup the text files that are formatted similarly to IIS Logs in text files.įor example, our Exchange OWA sites are behind the Netscaler and sending exchange iis logs to QRadar. The Websites that are behind the Load-balance or Reverse-proxy function are not supported by a QRadar DSM.
Both of the following methods should work.Username/Password -> Push -> LoginUsername/(Password),(OTP) -> Login.I’m working on getting Citrix Netscaler Web Logging Client log events into Qradar.Ĭitrix Netscaler and Access Gateway is supported for the Admin events and the VPN events. TestLog in to your Access Gateway as normal, and test the RADIUS auth. Note: If you do not want to bind the polices globally, you can map them on a virtual server-by-virtual server basis, by selecting the virtual server in question, and mapping up the authentication policies from the edit screen. Set the Receiver policy with Priority 90, and the WebPortal policy at 100. Select Add Binding, and add both policies. Select Primary Global Bindings from the Policy tab. Navigate to NetScaler Gateway > Policies > Authentication > RADIUS.Īdd a server, using the IP Address and Client secret you configured in Passly as the RADIUS client.Note: We recommend that you change the Time-out (seconds) from 3 to 15.Ĭreate a Policy for the Web Portal:Name: Passly Citrix WebPortalServer: (The server you created in the prior step)Expression: User-Agent NOTCONTAINS CitrixReceiverĬreate a Policy for the Citrix Receiver.Name: Passly Citrix ReceiverServer: The server you createdExpression: User-Agent CONTAINS CitrixReceiver
To configure a Citrix NetScaler you will need to have a configured an Passly RADIUS agent. How can we configure a Citrix NetScaler for RAIDUS? Configuring a NetScaler with RADIUS - Connect IT Community | Kaseya
0 kommentar(er)
