Scenario: A Citrix Administrator entered the configuration below: > add rewrite policy pol_external_to_internal…

When a Citrix ADC rewrite policy evaluates to TRUE, it can trigger an associated action. In addition to user-defined actions that modify requests or responses (e.g., INSERTHTTPHEADER, REPLACE), Citrix ADC provides several built-in rewrite actions. These actions perform control functions rather than data manipulation.

The available built-in rewrite actions are NOOP, RESET, and DROP. From the options provided, RESET terminates the TCP connection by sending a TCP RST packet to the client, while DROP silently discards the request without sending any response. Both are valid actions that can be bound to a rewrite policy.

A. Deny: This is not a valid rewrite action type. "Deny" or "Block" are actions associated with the Citrix Web App Firewall (WAF) feature to prevent malicious requests.

B. Bypass: This is a term used to describe the process of skipping a feature's processing (e.g., caching or compression) for specific traffic; it is not a configurable rewrite action.

1. Citrix ADC 13.1 Product Documentation

"Rewrite": In the section "Configuring a Rewrite Policy

" the documentation for the add rewrite policy command specifies the parameter. It states

"Name of the rewrite action to perform if the request or response matches this rewrite policy. There are also some built-in actions which can be used. These are: NOOP

RESET

DROP." This directly confirms that RESET and DROP are valid built-in actions.

2. Citrix ADC 13.1 Product Documentation

"Rewrite Actions": The "Built-in rewrite actions" subsection explicitly lists and describes NOOP

RESET

and DROP as the available built-in actions for the rewrite feature.

3. Citrix ADC 13.1 Product Documentation

"Web App Firewall Protections": This documentation details the actions available for Application Firewall security checks

which include block

log

stats

and learn. This confirms that blocking or denying traffic is a function of the Web App Firewall

not the Rewrite feature.