NetScaler 10.5 VPX

# THIS SCRIPT IS NOT READY !!!
#
# change the hostname
set ns hostname
# local accounts
show system user
add system user henry Password1
bind system user henry superuser 1
show system user > local-accounts.txt
# DNS server
add dns nameServer 192.168.0.4
add dns suffix example.local
sh dns nameServer > nameserver.txt
sh dns suffix >> nameserver.txt
# NTP server
add ntp server 192.168.0.8
enable ntp sync
show ntp server > ntp-server.txt
show ntp status >> ntp-server.txt
# Linking to the Active Directory
add system group "Domain Admins"
bind system group "Domain Admins" -policyName superuser 1
add authentication ldapAction auth_ad -serverIP 192.168.0.4
-ldapBase "DC=example,DC=local"
-ldapBindDn administrator@example.local
-ldapBindDnPassword Password1 -ldaploginName samAccountName
-groupAttrName memberOf -subAttributeName CN
add authentication ldapPolicy auth_policy ns_true auth_ad
bind system global auth_policy -priority 100
# Timeouts
set system group "Domain Admins" -timeOut 0
show system group "Domain Admins" > timeouts.txt
# add an SNIP or an MIP address to NetScaler
add ns ip 192.168.0.203 255.255.255.0 -type MIP
sh ns ip
save ns config
# create a VLAN
add vlan 20 –aliasName "Network 1"
# next, we need to bind it to an interface.
bind vlan 2 -ifnum 1/8
# show license
show license > license.txt
# Deploying ICA Proxy, enable the NetScaler Gateway feature
enable ns feature SSLVPN
# Load Balancing
enable feature LB
show feature | grep LB > loadbalancing.txt
add server www1 192.168.0.72
add server www2 192.168.0.73
show server >> loadbalancing.txt
add service w1-web www1 HTTP 80
add service w2-web www2 HTTP 80
show service >> loadbalancing.txt
add lb vserver lbvswww HTTP 192.168.0.204 80 -lbmethod ROUNDROBIN
show vserver lbvswww >> loadbalancing.txt
# Netscaler security (SSL Labs)
# https://blog.cjharms.info/2014/05/enable-forward-secrecy-and-secure.html (Forward Secrecy)
#
# Create a DH Key under Traffic Management => SSL => “Create Diffie-Hellman (DH) Key)”.
# Filename:              dhkey-2048.key
# DH Parameters (Bits):  2048
# DH Generator:          2
#
# Go to NetScaler Gateway Virtual Server => SSL Parameters.
# Enable DH Param:       check
# Refesh Count:          1000
# File Path*:            /nsconfig/ssl/dhkey-2048.key
#
# Scoring an A+ at SSLlabs.com with Citrix NetScaler (the sequel)
# http://blogs.citrix.com/2015/05/22/scoring-an-a-at-ssllabs-com-with-citrix-netscaler-the-sequel/
#
# Disable SSLv3 still needs to be scripted
# Disable TLS 1.0 still needs to be scripted
# Disable TLS 1.1 still needs to be scripted
#
# Create a custom Cipher list (VPX)
#
add ssl cipher custom-cipher-list
bind ssl cipher custom-cipher-list -cipherName TLS1.2-ECDHE-RSA-AES-128-SHA256
bind ssl cipher custom-cipher-list -cipherName TLS1-ECDHE-RSA-AES256-SHA
bind ssl cipher custom-cipher-list -cipherName TLS1-ECDHE-RSA-AES128-SHA
bind ssl cipher custom-cipher-list -cipherName TLS1-DHE-RSA-AES-256-CBC-SHA
bind ssl cipher custom-cipher-list -cipherName TLS1-DHE-RSA-AES-128-CBC-SHA
bind ssl cipher custom-cipher-list -cipherName TLS1-AES-256-CBC-SHA
bind ssl cipher custom-cipher-list -cipherName TLS1-AES-128-CBC-SHA
bind ssl cipher custom-cipher-list -cipherName SSL3-DES-CBC3-SHA
#
#
# Strict Transport Security (STS or HSTS) with Citrix NetScaler and Access Gateway Enterprise
# http://blogs.citrix.com/2010/09/10/strict-transport-security-sts-or-hsts-with-citrix-netscaler-and-access-gateway-enterprise/
#
add rewrite action insert_STS_header insert_http_header Strict-Transport-Security "\"max-age=157680000\""
add rewrite policy enforce_STS "true" insert_STS_header
# someserver.example.local needs to be modified
bind lb vserver someserver.example.local -policyName enforce_STS -priority 100 -gotoPriorityExpression END -type RESPONSE
#
# Configure SSL Secure Renegotiations to FRONTEND_CLIENT.
set ssl parameter –denySSLreneg FRONTEND_CLIENT
#
# Enable HA
# Create the HA Pair
add ha node 1 192.168.0.205
add ha node 1 192.168.0.202
#
# change the default password
set system user nsroot password
# save config
save ns config