ADC NITRO APIs

appfwsettings

May 23, 2024

Contributed by:

Configuration for AS settings resource.

Properties

(click to see Operations )

Name	Data Type	Permissions	Description
defaultprofile		Read-write	Profile to use when a connection does not match any policy. Default setting is APPFW_BYPASS, which sends unmatched connections back to the Citrix ADC without attempting to filter them further. Default value: APPFW_BYPASS Minimum length = 1
undefaction		Read-write	Profile to use when an application firewall policy evaluates to undefined (UNDEF). An UNDEF event indicates an internal error condition. The APPFW_BLOCK built-in profile is the default setting. You can specify a different built-in or user-created profile as the UNDEF profile. Default value: APPFW_BLOCK Minimum length = 1
sessiontimeout		Read-write	Timeout, in seconds, after which a user session is terminated. Before continuing to use the protected web site, the user must establish a new session by opening a designated start URL. Default value: 900 Minimum value = 1 Maximum value = 65535
learnratelimit		Read-write	Maximum number of connections per second that the application firewall learning engine examines to generate new relaxations for learning-enabled security checks. The application firewall drops any connections above this limit from the list of connections used by the learning engine. Default value: 400 Minimum value = 1 Maximum value = 1000
sessionlifetime		Read-write	Maximum amount of time (in seconds) that the application firewall allows a user session to remain active, regardless of user activity. After this time, the user session is terminated. Before continuing to use the protected web site, the user must establish a new session by opening a designated start URL. A value of 0 represents infinite time. Default value: 0 Minimum value = 0 Maximum value = 2147483647
sessioncookiename		Read-write	Name of the session cookie that the application firewall uses to track user sessions. Must begin with a letter or number, and can consist of from 1 to 31 letters, numbers, and the hyphen (-) and underscore (_) symbols. The following requirement applies only to the Citrix ADC CLI If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my cookie name” or ‘my cookie name’). Minimum length = 1
clientiploggingheader		Read-write	Name of an HTTP header that contains the IP address that the client used to connect to the protected web site or service.
importsizelimit		Read-write	Maximum cumulative size in bytes of all objects imported to Netscaler. The user is not allowed to import an object if the operation exceeds the currently configured limit. Default value: 134217728 Minimum value = 1 Maximum value = 268435456
signatureautoupdate		Read-write	Flag used to enable/disable auto update signatures. Default value: OFF Possible values = ON, OFF
signatureurl		Read-write	URL to download the mapping file from server. Default value: https://s3.amazonaws.com/NSAppFwSignatures/SignaturesMapping.xml
cookiepostencryptprefix		Read-write	String that is prepended to all encrypted cookie values. Minimum length = 1
logmalformedreq		Read-write	Log requests that are so malformed that application firewall parsing doesn’t occur. Default value: ON Possible values = ON, OFF
geolocationlogging		Read-write	Enable Geo-Location Logging in CEF format logs. Default value: OFF Possible values = ON, OFF
ceflogging		Read-write	Enable CEF format logs. Default value: OFF Possible values = ON, OFF
entitydecoding		Read-write	Transform multibyte (double- or half-width) characters to single width characters. Default value: OFF Possible values = ON, OFF
useconfigurablesecretkey		Read-write	Use configurable secret key in AppFw operations. Default value: OFF Possible values = ON, OFF
sessionlimit		Read-write	Maximum number of sessions that the application firewall allows to be active, regardless of user activity. After the max_limit reaches, No more user session will be created . Default value: 100000 Minimum value = 0 Maximum value = 500000
malformedreqaction	<String[]>	Read-write	flag to define action on malformed requests that application firewall cannot parse. Possible values = none, block, log, stats
centralizedlearning		Read-write	Flag used to enable/disable ADM centralized learning. Default value: OFF Possible values = ON, OFF
proxyserver		Read-write	Proxy Server IP to get updated signatures from AWS.
proxyport		Read-write	Proxy Server Port to get updated signatures from AWS. Default value: 8080 Range 1 - 65535 * in CLI is represented as 65535 in NITRO API
proxyusername		Read-write	Proxy Username. Minimum length = 1
proxypassword		Read-write	Password with which proxy user logs on. Minimum length = 1
cookieflags		Read-write	Add the specified flags to AppFW cookies. Available setttings function as follows None - Do not add flags to AppFW cookies. HTTP Only - Add the HTTP Only flag to AppFW cookies, which prevent scripts from accessing them. Secure - Add Secure flag to AppFW cookies. All - Add both HTTPOnly and Secure flag to AppFW cookies. Default value: none Possible values = none, httpOnly, secure, all
learning		Read-only	Global learning option that overrides the profile level learning. Available settings are as follows ON - Honor all profile level learn settings. OFF - Avoids learning for all profiles ignoring profile level learn setting. Default value: ON Possible values = ON, OFF
builtin	<String[]>	Read-only	Flag to determine if application firewall settings is built-in or not. Possible values = MODIFIABLE, DELETABLE, IMMUTABLE, PARTITION_ALL
feature		Read-only	The feature to be checked while applying this config.

Operations

(click to see Properties )

UPDATE
UNSET
GET (ALL)

Some options that you can use for each operations:

Getting warnings in response: NITRO allows you to get warnings in an operation by specifying the 'warning' query parameter as 'yes'. For example, to get warnings while connecting to the NetScaler appliance, the URL is as follows:

http:// <netscaler-ip-address> /nitro/v1/config/login?warning=yes

If any, the warnings are displayed in the response payload with the HTTP code '209 X-NITRO-WARNING'.
Authenticated access for individual NITRO operations: NITRO allows you to logon to the NetScaler appliance to perform individual operations. You can use this option instead of creating a NITRO session (using the login object) and then using that session to perform all operations,

To do this, you must specify the username and password in the request header of the NITRO request as follows:

X-NITRO-USER: <username>

X-NITRO-PASS: <password>

Note: In such cases, make sure that the request header DOES not include the following:

Cookie:NITRO_AUTH_TOKEN= <tokenvalue>

*Note:* Mandatory parameters are marked in red and placeholder content is marked in green

unset

URL: http:// <netscaler-ip-address> /nitro/v1/config/appfwsettings? action=unset HTTP Method: POST

Request Headers:

Cookie:NITRO_AUTH_TOKEN= <tokenvalue>

Content-Type:application/json

Request Payload:

{"appfwsettings":{
"defaultprofile":true,
"undefaction":true,
"sessiontimeout":true,
"learnratelimit":true,
"sessionlifetime":true,
"sessioncookiename":true,
"clientiploggingheader":true,
"importsizelimit":true,
"signatureautoupdate":true,
"signatureurl":true,
"cookiepostencryptprefix":true,
"logmalformedreq":true,
"geolocationlogging":true,
"ceflogging":true,
"entitydecoding":true,
"useconfigurablesecretkey":true,
"sessionlimit":true,
"malformedreqaction":true,
"centralizedlearning":true,
"proxyserver":true,
"proxyport":true,
"proxyusername":true,
"proxypassword":true,
"cookieflags":true
}}

<!--NeedCopy-->

Response: HTTP Status Code on Success: 200 OK

HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error

update

URL: http:// <netscaler-ip-address> /nitro/v1/config/appfwsettings HTTP Method: PUT

Request Headers:

Cookie:NITRO_AUTH_TOKEN= <tokenvalue>

Content-Type:application/json

Request Payload:

{"appfwsettings":{
"defaultprofile":<String_value>,
"undefaction":<String_value>,
"sessiontimeout":<Double_value>,
"learnratelimit":<Double_value>,
"sessionlifetime":<Double_value>,
"sessioncookiename":<String_value>,
"clientiploggingheader":<String_value>,
"importsizelimit":<Double_value>,
"signatureautoupdate":<String_value>,
"signatureurl":<String_value>,
"cookiepostencryptprefix":<String_value>,
"logmalformedreq":<String_value>,
"geolocationlogging":<String_value>,
"ceflogging":<String_value>,
"entitydecoding":<String_value>,
"useconfigurablesecretkey":<String_value>,
"sessionlimit":<Double_value>,
"malformedreqaction":<String[]_value>,
"centralizedlearning":<String_value>,
"proxyserver":<String_value>,
"proxyport":<Integer_value>,
"proxyusername":<String_value>,
"proxypassword":<String_value>,
"cookieflags":<String_value>
}}

<!--NeedCopy-->

Response: HTTP Status Code on Success: 200 OK

HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error

get (all)

URL: http:// <netscaler-ip-address> /nitro/v1/config/appfwsettings HTTP Method: GET

Request Headers:

Cookie:NITRO_AUTH_TOKEN= <tokenvalue>

Accept:application/json

Response: HTTP Status Code on Success: 200 OK

HTTP Status Code on Failure: 4xx <string> (for general HTTP errors) or 5xx <string> (for NetScaler-specific errors). The response payload provides details of the error

Response Header:

Content-Type:application/json

Response Payload:

{ "appfwsettings": [ {
"defaultprofile":<String_value>,
"undefaction":<String_value>,
"sessiontimeout":<Double_value>,
"learnratelimit":<Double_value>,
"sessionlifetime":<Double_value>,
"sessioncookiename":<String_value>,
"clientiploggingheader":<String_value>,
"importsizelimit":<Double_value>,
"signatureautoupdate":<String_value>,
"signatureurl":<String_value>,
"cookiepostencryptprefix":<String_value>,
"logmalformedreq":<String_value>,
"geolocationlogging":<String_value>,
"ceflogging":<String_value>,
"entitydecoding":<String_value>,
"useconfigurablesecretkey":<String_value>,
"sessionlimit":<Double_value>,
"malformedreqaction":<String[]_value>,
"learning":<String_value>,
"centralizedlearning":<String_value>,
"proxyserver":<String_value>,
"proxyport":<Integer_value>,
"proxyusername":<String_value>,
"proxypassword":<String_value>,
"cookieflags":<String_value>,
"builtin":<String[]_value>,
"feature":<String_value>
}]}

<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

appfwsettings

May 23, 2024

Contributed by:

May 23, 2024

Contributed by:

appfwsettings

Properties

Operations

unset

update

get (all)

In this article