Citrix Systems Network Router 9.2 User Manual

1.

In the navigation pane, expand Application Firewall, and then click 
Profiles.

2.

In the details view, click Add.

3.

In the Create Application Firewall Profile dialog box, create a Web 
Application profile with advanced defaults and name it pr_xssokay. 
Click Create and then click Close.

4.

In the details view, click the profile, click Open, and in the Configure Web 
Application Profile dialog box, configure the pr_xssokay profile as 
shown below.

•

Start URL Check: Clear all actions.

•

Cookie Consistency Check: Disable blocking.

•

Form Field Consistency Check: Disable blocking.

•

Cross-Site Scripting Check: Disable blocking.

This should prevent blocking of legitimate requests involving Web pages 
with cross-site scripting that you know are nonetheless safe.

5.

Click Policies, and then click Add.

6.

In the Create Application Firewall Policy dialog box, create a policy that 
detects connections to your scripted Web pages and applies the 
pr_xssokay

 profile:

•

Policy name: pol_xssokay

•

Associated profile: pr_xssokay

•

Policy expression: 

7.

Globally bind your new policy to put it into effect.

The following example describes how to create a DNS action and DNS policy 
that detects connections from unwanted IPs or networks, such as those used in a 
DDOS attack, and drops all packets from those locations. The example shows 
networks within the IANA reserved IP block 192.168.0.0/16. A hostile 
network will normally be on publicly routable IPs.