Netscaler Knowledgebase

The following is NOT supported by Citrix, if you have trouble with it, to bad, you are on your own, yet it can be done.

We have found that this is not supported by Citrix because it is not compatible with Edge Sight (mutually exclusive).

I found the following by my own, using trial and error. It only works without SSL.

Its quite simple really, do the following, keep in mind that these procedure has some limitations, as of build 47.8, the ns will only rewrite the body until byte 8534 of the body starting from the last byte, and that SSL is not being used.

* Policy
** Name: search_ip_resp
** Action: erase_ip_all
** Undefined Action: -Global Undefined action -
** Expression: HTTP.RES.CONTENT_LENGTH.GT(0)

* Action
** Name: erase_ip_all
** type: DELETE ALL
** Expression to choose Target: http.RES.BODY(10000)
** Pattern: re!http://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}!

This case errases any ip found in the body of the response, really usefull when the web app has the ip hard coded in the html pages it shows.
The same can be done with App Firewall.

On netscaler 8.0 it is posible and fairly simple, this is what I tried and it worked. I have no idea if it works on NS 7.0.

Policy:
CLIENT.IP.SRC.EQ(1.2.3.4)

Action:
Type:
Replace
Target:
http.RES.HEADER("TEST")
Replacement.
"1.2.3.5"

Thats it, it work because for netscaler the req and res are independant, you just have to keep in mind that on the same process (req or res) you cannot base a rule on the result value of another rule.

If you need help just post it.