Reducing application pay-per-request costs with Citrix NetScaler

In today’s cloud-first landscape, where applications are frequently billed on a pay-per-request basis, every incoming request carries a direct cost. Not all requests are legitimate or necessary and many are redundant, malicious, or outright abusive. Letting these through not only inflates operating expenses and degrades performance, but can also introduce serious security threats to your business applications.

That’s where Citrix NetScaler steps in as your trusted cost-saving partner. By intelligently processing, filtering, and blocking unwanted traffic right at the edge, NetScaler dramatically reduces backend load and eliminates the expenses associated with handling non-essential requests. In this article, we explore practical strategies for leveraging NetScaler’s advanced capabilities, such as IP Reputation, GEO blocking, and caching, to cut your application’s pay-per-request costs, while strengthening your security posture.

Integrated Caching

Integrated caching utilizes in-memory storage on the NetScaler appliance to deliver web content to users without requiring a round trip to the origin server. Since cached objects are stored in memory, the first step is to set a global memory limit for caching. Citrix recommends allocating less than half of the total available memory for this purpose.

Example: check the available memory from the FreeBSD shell, then confirm the configured cache memory limit on the NetScaler CLI.

root@ns# grep "memory" /var/nslog/dmesg.boot
real memory  = 15032385536 (14336 MB)
avail memory = 14108774400 (13455 MB)
root@ns# exit
logout

 Done
> sh run | grep -i "set cache parameter"
set cache parameter -memLimit 4096 -via "NS-CACHE-10.0: 27"

Objects are organized into content groups, and you can create custom groups for specific content types. Configure selectors and apply them to content groups for efficient caching. Once configured, attach caching policies, based on rule expressions, to your virtual servers for fine-grained control.

Basic setup:

#Create selector
add cache selector IC_SEL_GETALL HTTP.REQ.URL "HTTP.REQ.HEADER(\"Host\").TO_LOWER.CONTAINS(\"www\")"

#Create content group
add cache contentGroup IC_CG_WEBTST_GETALL -relExpiry 300 -absExpiry 00:10 -prefetch NO -insertETag NO -maxResSize 2048 -hitSelector IC_SEL_GETALL

#Create caching policy
add cache policy IC_POL_WEBTST_GET_ALL_C -rule "HTTP.REQ.METHOD.EQ(GET)" -action CACHE -storeInGroup IC_CG_WEBTST_GETALL -undefAction NOCACHE

#Bind policy to virtual server
bind lb vserver LB_VS_WEBTST -policyName IC_POL_WEBTST_GET_ALL_C -priority 130 -gotoPriorityExpression END -type REQUEST

A few settings explained that might be considered:

• Do not cache - if size is less than : prevents caching objects that are to small
• Do not cache - if size exceeds : prevents caching objects that are to large
• Do not cache - if hits are less than : prevents caching objects that are not accessed frequently
• Maximum memory usage limit for the content group : limits memory usage for the content group
• Prefetch : attempt to refresh objects that are about to go stale
• Flash cache : queues requests that arrive simultaneously, NetScaler sends only one request to the backend server, retrieves the response, and distributes it to all the clients whose requests are in the queue.

To verify the caching statistics run: stat cache detail

IP Reputation (IPREP)

IPREP uses real-time threat intelligence to identify and block traffic from known malicious IP addresses. NetScaler uses Webroot by OpenText to categorize IPs based on behaviour, such as botnets, scanners, spammers, or attackers, and enables you to take automated actions like blocking, redirecting, or logging based on the IP’s reputation score.

• To access the Webroot database, the NetScaler appliance must be able to connect to api.bcti.brightcloud.com on port 443.
• BrightCloud (OpenText) provides a IP lookup tool: https://www.brightcloud.com/tools/url-ip-lookup.php
• NetScaler is storing logs in the following location: /var/log/iprep.log

CLI Example to block all malicious identified clients on a CS server:

add audit messageaction AUDIT_IPREP INFORMATIONAL "\"LOGTYPE=LOG_IPREP HOSTNAME=\" +  HTTP.REQ.HOSTNAME.SERVER + \" HTTP_REQ=\" +  HTTP.REQ.URL + \"  SRC_IP=\" +  CLIENT.IP.SRC  + \" DST_IP=\" +  CLIENT.IP.DST  + \" USER-AGENT=\" +  HTTP.REQ.HEADER(\"User-Agent\") +  \" Location=\" + CLIENT.IP.SRC.LOCATION" -logtoNewnslog YES
add responder action RS_AC_Blocked respondwith q{"HTTP/1.0 200 OK" +"\r\n\r\n" + "<html><body>This IP address ("+ CLIENT.IP.SRC +") is blocked to connect to this service.</body></html>" + "\r\n"}
add responder policy RS_PL_IPREP CLIENT.IP.SRC.IPREP_IS_MALICIOUS RS_AC_Blocked -logAction AUDIT_IPREP
bind cs vserver CS_VS_RP_SSL443 -policyName RS_PL_IPREP -priority 100 -gotoPriorityExpression END -type REQUEST

• Note: Required URLs for NetScaler database updates:

  • localdb-ip-daily.brightcloud.com:443
  • localdb-ip-rtu.brightcloud.com:443
  • api.bcti.brightcloud.com:443
  • localdb-ipv6-daily.brightcloud.com:443
  • ipce-daily.brightcloud.com:443
  • ipce-rtu.brightcloud.com:443

GEO Location

Citrix NetScaler ships with built-in GEO IP databases, found at /var/netscaler/inbuilt_db/ (powered by MaxMind GeoLite2), but these are not regularly updated by Citrix. To ensure accuracy, you can download and import updated databases:

• MaxMind GeoLite2: Download Here
• IP2Location Lite: Download Here

IPv4 IP2Location integration example:

1. Download IP2LOCATION-LITE-DB3.CSV and place it at /var/netscaler/locdb on your appliance.

Issue the below command:

add locationFile /var/netscaler/inbuilt_db/IP2LOCATION-LITE-DB3.CSV -format ip-country-region-city

Verify that the database are correctly loaded using:

show locationparameter
show locationfile

> sh locationparameter
Static Proximity
----------------
Database mode: File
Context: geographic
Qualifier 1 label: Continent
Qualifier 2 label: Country_Code
Qualifier 3 label: Subdivision_1_Name
Qualifier 4 label: Subdivision_2_Name
Qualifier 5 label: City
Qualifier 6 label: Organization

IPv4 Location File
Location file (format: ip-country-region-city):
 IP2LOCATION-LITE-DB3.CSV
Flushing: Idle; Loading: Idle
Lines: 3026992 Warnings: 0 Errors: 0
Current static entries: 3026992  Current custom entries: 0

Functionality can easily be tested on the NetScaler by going into the shell and using:

root@ns# nsmap -d -t

By default the GOE location databases are not loaded:

> sh locationparameter
Static Proximity
----------------
Database mode: Not applicable
Context: geographic
Qualifier 1 label: Continent
Qualifier 2 label: Country
Qualifier 3 label: Region
Qualifier 4 label: City
Qualifier 5 label: ISP
Qualifier 6 label: Organization

IPv4 Location File
Location file (format: ):
 Not loaded
Flushing: Idle; Loading: Idle
Lines: 0 Warnings: 0 Errors: 0
Current static entries: 0  Current custom entries: 0

IPv6 Location File
Location file (format: ):
 Not loaded
Flushing: Idle; Loading: Idle
Lines: 0 Warnings: 0 Errors: 0
Current static entries: 0  Current custom entries: 0

Match wildcard qualifier to any: NO
 Done

To load build in databases:

add locationFile /var/netscaler/inbuilt_db/Citrix_Netscaler_InBuilt_GeoIP_DB_IPv4 -format netscaler
add locationFile6 /var/netscaler/inbuilt_db/Citrix_Netscaler_InBuilt_GeoIP_DB_IPv6 -format netscaler

Advanced: BOT Management

Already handling bots? We previously covered effective bot management with NetScaler on our blog page.

Takeaway

Today, cost control is security and vice versa. Citrix NetScaler arms you with actionable tools (caching, IP reputation, GEO rules) to ensure you pay only for what matters and keep your cloud app safe, fast, and efficient.

Ready to cut costs and secure your cloud applications? Click here to schedule a direct call with one of our top NetScaler experts and get tailored advice for your business.

Tagged: Citrix NetScaler, Cloud Cost Saving, IP reputation, Application Security, integrated caching, GEO blocking, pay-per-request, backend optimization, cloud application, bot management