NetScaler Responder Policy not working as expected when LB is configured to use AAA

NetScaler Responder Policy not working as expected when LB is configured to use AAA

book

Article ID: CTX693187

calendar_today

Updated On:

Description

Having defined a Responder Policy for use and binding it to a Load Balancing virtual server, you find that Policy Hits are seen and Responder Action used only when no Authentication Host is configured on the Load Balancer. When using the Load Balancer with an Authentication Host configured for use, then the Responder Policy does not become hit and the Responder Action goes unused. 

Resolution

Move the binding location of the Responder Policy from the Load Balancing virtual server to the Authentication virtual server which is defined as the Authentication Host. When binding the Responder Policy to the new location, choose the "AAA_Request" or "AAA_Response" type, rather than choosing "Request" or "Response" type of binding.


Problem Cause

The Load Balancing virtual server will send traffic to the Authentication Host first, before successful authentication can take place and traffic flow returns to the Load Balancer, so that Policies on the Load Balancer can become processed. In some scenarios, such as when using the Responder Policies for CORS headers, then it is desired to have policies become processed even before authentication has taken place. In this scenario, the AAA virtual server should be the binding location for the Policies, with binding type modified from "Request" or "Response" type (intended for HTTP traffic being processed by the Load Balancer) into "AAA_Request" or "AAA_Response" (capable of targeting the same traffic as it becomes processed by the AAA virtual server).

Additional Information

https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/entities-of-authentication-authorization-auditing/authentication-virtual-server.html