We, my college and I, where doing a XenMobile installation at a customer, which had a strict logging policy. The users where allow internet access through Secure Web App in XenMobile.
All internet traffic had to go out of the company Firewall, for security reasons. When doing this the NetScaler SNIP is logged in the Firewall, but the customer wants the user’s devices IP address logged.
We came up with a custom logging solution with a syslog server. The syslog server configuration on the NetScaler was done, se more here:
How to Configure Syslog on a NetScaler Appliance
https://support.citrix.com/article/CTX121728
When that was done, I configured an Auditing Message Actions:
With this I log the device IP and the requested URL.
The I made an Rewrite policy, with the flowing settings:
This will not do any rewrite, as action is set to NOREWRITE, but it will use the Auditing Message Actions and send the information to the syslog server.
Finally, I bound the rewrite policy to the XenMobile Access Gateway configuration:
For the test I tried to access http://dr.dk with in the Secure Web App, and I found the flowing logging on the syslog server:
Conclusion:
We ended up with a logging of the device IP and the access URL. With the many expressions available on the NetScaler you would be able to log almost everything in the syslog server.
Remember to bound the rewrite policy with NEXT as Goto Expression, or you could end up with others rewrite policies not being processed.
CLI commands:
add audit messageaction log_act_custom ALERT “\”Client:\”+CLIENT.IP.SRC+\” accessed \”+HTTP.REQ.URL”
add rewrite policy log_rw_pol true NOREWRITE -logAction log_act_custom
bind vpn vserver < Gateway virtual server name> -policy log_rw_pol -priority 100 -gotoPriorityExpression NEXT -type REQUEST