How to check client security string limitation for preauthentication EPA scan

How to check client security string limitation for preauthentication EPA scan

book

Article ID: CTX294160

calendar_today

Updated On:

Description

This article is to explain the limitation of client security string of preauthentication EPA scan and about how to check it from log

Instructions

Limitation 
Maximum amount of client secure string is 256

Configuration sample

add aaa preauthenticationpolicy MacPolicyTest1 "CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest[COMMENT: MAC Address]\') EXISTS ||  CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest[COMMENT: MAC Address]\') EXISTS " MacPreAuthTest
...
add aaa preauthenticationpolicy MacPolicyTestN "CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest[COMMENT: MAC Address]\') EXISTS ||  CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest[COMMENT: MAC Address]\') EXISTS " MacPreAuthTest
add aaa preauthenticationaction MacPreAuthTest ALLOW
bind vpn vserver vpnTest -policy MacPolicyTest1 -priority 100
...
bind vpn vserver vpnTest -policy MacPolicyTestN -priority 100


What's the client security string
Generated from the expression in preauthentication policy and sent to EPA plugin client for scanning, and each expression will be converted as one client string,  take policy MacPolicyTest1 as example:
---------------------------------
add aaa preauthenticationpolicy MacPolicyTest1 "CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest1[COMMENT: MAC Address]\') EXISTS ||  CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtestN[COMMENT: MAC Address]\') EXISTS " MacPreAuthTe
---------------------------------

 
CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtest1[COMMENT: MAC Address]\') EXISTS and CLIENT.SYSTEM(\'MAC_ADDR_anyof_MACaddrtestN[COMMENT: MAC Address]\') EXISTS will both be used to create secure string and sent to the client plugin. 
 

How to check the hit of the limitation
We could check the hit in the client log, following sample would be the proof
nsepa.txt
---------------------------------------
21:59:40.281 | DEBUG   | ns_EvalPolicy: MAC_ADDR_anyof_111111111111
21:59:40.281 | DEBUG   | ns_EvalPolicy: MAC_ADDR_anyof_111111111111 returns 2004
21:59:40.281 | EVENT   | ns_EvalPolicy returns 2004
21:59:40.281 | DEBUG   | ns_free_dependspol:num_mallocPolicyBuffer=0
21:59:40.282 | ERROR   | ns_check_depends_multiple | 3741 | Exceeded maximum client security strings limit
21:59:40.282 | EVENT   | Exceeded 256 client security strings
21:59:40.282 | DEBUG   | Memory has been allocated for the buffer. 
21:59:40.282 | DEBUG   | Memory has been allocated for the buffer. 
21:59:40.282 | EVENT   | Making GET request to https://test.vpn.com:443epas
21:59:40.282 | VERBOSE | [<GET epas HTTP/1.1

Cookie: NSC_EPAC=*****************************************************************

CSEC: 
3333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333333
---------------------------------------


Please refer to following KB for how to enable and collect log for troubleshooting EPA scan
CTX209148 Understanding and Configuring EPA Verbose Logging on NetScaler Gateway





 

Powered by Wolken Software