Source IP address whitelisting for GSLB communication channels

Last published : Sep 24, 2026
GSLB systems distribute network traffic across geographically dispersed servers to ensure high availability and optimal performance. To secure these environments, Source IP address whitelisting feature now provides a unified security layer for both the Metric Exchange Protocol (MEP) and GSLB configuration synchronization.
  • Unified Protection: Administrators can ensure only authorized source IP addresses initiate MEP exchanges and configuration synchronization.
  • Security Mitigation: This approach directly helps in stopping dictionary-based password attacks and maintains the integrity of the distributed environment.
Related information

Source IP address specification

By default, NetScaler uses the Subnet IP address (SNIP) for MEP communication and the NetScaler IP address (NSIP) for configuration synchronization. The updated srcIP setting on the rpcnode consolidates the networking requirements for GSLB traffic:
  • Port 3009 (MEP): Metric Exchange Protocol traffic.
  • Port 22 (SSH) / 3008: Configuration Synchronization traffic.
  • Unified Rule: The srcIP setting, which was previously effective only for MEP, now applies to GSLB Configuration Synchronization as well.
  • Firewall Simplification: When multiple SNIPs are available, the receiving firewall traditionally had to include all possible SNIPs. With this configuration, the receiver can reliably anticipate traffic from a single, recognized IP address.
  • Legacy Retirement: This enhancement eliminates the need for configuring ACLs and RNAT (previously required to source FreeBSD-originated traffic from a SNIP).

Enforcement and dataset binding

By default, remote nodes do not validate the source IP address of incoming MEP traffic. Enabling the source IP address whitelisting feature forces the remote node to verify incoming packets against specific internal datasets.

Dataset requirements

To enforce restrictions, the authorized IP address is to be bound to the appropriate dataset:
  • IPv4: gslbSourceIPWhitelistingV4
  • IPv6: gslbSourceIPWhitelistingV6

Source IP address specification enforcement

  • Mandatory binding: If a specific source IP address is explicitly configured under the rpcnode, that exact IP address is to be bound to the corresponding whitelist dataset to be recognized.
  • Default site IP address logic: If no specific source IP address is provided, the system defaults to the GSLB Site IP address. In this case, the GSLB Site IP address is automatically added to the whitelist.
  • NAT Environment Handling: For GSLB sites behind a NAT, the Public IP address (the address to which the intranet SNIP is translated) must be bound to the dataset, not the internal intranet IP address.

Benefits

  • Enhanced Security: Limits communication to specified IP addresses, minimizing unauthorized access.
  • Firewall Simplification: The receiver reliably anticipates traffic from a single, recognized IP address, even when multiple SNIPs are present.
  • Operational Efficiency: Replaces complex, manual FreeBSD-based traffic sourcing with a single rpcnode parameter.

Configure the Source IP address whitelisting feature by using the CLI

Enable Source IP address whitelisting

set gslb parameter -sourceIPWhitelisting ENABLED

Bind authorized IP addresses to the whitelist dataset

  • IPv4: bind dataset gslbSourceIPWhitelistingV4 <Authorized_Source_IP>
  • IPv6: bind dataset gslbSourceIPWhitelistingV6 <Authorized_Source_IP_v6>

Verify configuration status

sh gslb parameter

Enable Source IPaddress whitelisting by using the GUI

  1. Navigate to Traffic Management > GSLB > Dashboard.
  2. Select Change GSLB Settings.
  3. Select the SourceIP Whitelisting option.