For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Carl_Brothers's avatar
Carl_Brothers
Icon for Employee rankEmployee
Nov 16, 2010

Citrix XenApp APM deployment Guide

Looking into using APM to replace CITRIX CAG/CSG for a new project, but I have a small stumbling block.     My employer is BIG and has quite a few citrix servers, so the static data group sugges...
app sec
BIG-IP Access Policy Manager (APM)
security
Carl_Brothers's avatar
Carl_Brothers
Icon for Employee rankEmployee
Nov 17, 2010
As I was evaluating the options possible, I was thinking of the possible paths to make this check easier:

- Use the Subnet mask/CIDR notations in the datagroup

 

- Dynamically update the datagroup at run time as Xenapp servers are learned from the ICA files passed from the Web interface.

 

- Create a process that would leverage Icontrol to query the XenApp infrastructure for valid hosts and to then update the datagroup.

 

 

 

What I did not consider was to simply remove this additional validation that the target server is actually valid for this virtual server. As the ICA files are coming from the XML Broker via the Web interface, it is logical to trust that communication, unless you really fear a man in the middle type attack that would generate ica files.

 

 

 

So I have my solution for now.

 

 

 

I would like to know if there is a routine in iRules to match an IP to a subnet in CIDR notation.

 

 

 

Thanks,

 

 

 

CarlB