-
-
-
-
-
-
-
ns-acl6
-
-
-
-
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
ns-acl6
The following operations can be performed on “ns-acl6”:
show ns acl6
Displays settings related to the ACL6 rules. To display settings of all the ACL6 rules, run the command without any parameters. To display settings of a particular ACL6 rule, specify the name of the ACL6 rule.
Synopsis
show ns acl6 [
Arguments
acl6name Name of the ACL6 rule whose details you want the Citrix ADC to display.
type default will display both CLASSIC and DFD
Possible values: CLASSIC, DFD
Output
acl6action Action to perform on the incoming IPv6 packets that match the ACL6 rule. Available settings function as follows:
- ALLOW - The Citrix ADC processes the packet.
- BRIDGE - The Citrix ADC bridges the packet to the destination without processing it.
- DENY - The Citrix ADC drops the packet.
srcMac MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value “000000111111”.
stateflag ACL6 state flag.
protocol Protocol number in IPv6 header or name.
protocolNumber Protocol number in IPv6 header or name.
srcPortVal Source port (range).
operator Either the equals (=) or does not equal (!=) logical operator.
destPortVal Destination port (range).
operator Either the equals (=) or does not equal (!=) logical operator.
srcIPv6Val Source IPv6 address (range).
operator Either the equals (=) or does not equal (!=) logical operator.
destIPv6Val Destination IPv6 address (range).
operator Either the equals (=) or does not equal (!=) logical operator.
vlan ID of the VLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs.
vxlan ID of the VXLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs.
state State of the ACL6.
kernelstate Commit status of the ACL6.
TTL Time left to expire ACL6 (in seconds).
icmpType ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol.
icmpCode Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter.
interface ID of an interface. The Citrix ADC applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
hits Number of hits of this ACL6.
established This flag indicates that the ACL6 should be used for TCP response traffic only.
priority Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created.
logstate Enable or disable logging of events related to the ACL6 rule. The log messages are stored in the configured syslog or auditlog server.
ratelimit Packet rate limit for acl logging
time Time when this acl is applied.
td Integer value that uniquely identifies the traffic domain in which you want to configure the entity. If you do not specify an ID, the entity becomes part of the default traffic domain, which has an ID of 0.
aclassociate ACL6 linked
dfdhash Specifies the type of hashmethod to be applied, to steer the packet to the FP of the packet.
dfdprefix hashprefix to be applied to SIP/DIP to generate rsshash FP.eg 128 => hash calculated on the complete IP
stateful If stateful option is enabled, transparent sessions are created for the traffic hitting this ACL6 and not hitting any other features like LB, INAT etc.
devno count
Example
show ns acl6 rule1 1) Name: r1 Action: DENY srcIPv6 = 2001::1 destIPv6 srcMac: srcMacMask: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 Hits: 0 TTL:
rename ns acl6
Renames an ACL6 rule. To commit this operation, you must apply the ACL6s.
Synopsis
rename ns acl6
Arguments
acl6name Name of the ACL6 rule that you want to rename.
newName New name for the ACL6 rule. Must begin with an ASCII alphabetic or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters.
Example
rename acl6 rule rule-new
set ns acl6
Modifies the parameters of an ACL6 rule. To commit this operation, you must apply the ACL6s.
Synopsis
set ns acl6
Arguments
acl6name Name of the ACL6 rule whose parameters you want to modify.
aclaction Action associated with the ACL6.
Possible values: BRIDGE, DENY, ALLOW
srcIPv6 IP address or range of IP addresses to match against the source IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcIPv6Val Source IPv6 address (range).
srcPort Source Port (range).
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcPortVal Source port (range). Maximum value: 65535
destIPv6 IP address or range of IP addresses to match against the destination IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
destIPv6Val Destination IPv6 address (range).
destPort Destination Port (range).
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
destPortVal Destination port (range). Maximum value: 65535
srcMac MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value “000000111111”. Default value: “000000000000”
protocol Protocol, identified by protocol name, to match against the protocol of an incoming IPv6 packet.
Possible values: ICMPV6, TCP, UDP, ICMP, IGMP, EGP, IGP, ARGUS, RDP, RSVP, EIGRP, L2TP, ISIS, GGP, IPoverIP, ST, CBT, BBN-RCC-M, NVP-II, PUP, EMCON, XNET, CHAOS, MUX, DCN-MEAS, HMP, PRM, XNS-IDP, TRUNK-1, TRUNK-2, LEAF-1, LEAF-2, IRTP, ISO-TP4, NETBLT, MFE-NSP, MERIT-INP, SEP, 3PC, IDPR, XTP, DDP, IDPR-CMTP, TP++, IL, IPv6, SDRP, IPv6-Route, IPv6-Frag, IDRP, GRE, MHRP, BNA, ESP, AH, I-NLSP, SWIPE, NARP, MOBILE, TLSP, SKIP, IPv6-NoNx, IPv6-Opts, Any-Host-Internal-Protocol, CFTP, Any-Local-Network, SAT-EXPAK, KRYPTOLAN, RVD, IPPC, Any-Distributed-File-System, TFTP, VISA, IPCV, CPNX, CPHB, WSN, PVP, BR-SAT-MO, SUN-ND, WB-MON, WB-EXPAK, ISO-IP, VMTP, SECURE-VM, VINES, TTP, NSFNET-IG, DGP, TCF, OSPFIGP, Sprite-RP, LARP, MTP, AX.25, IPIP, MICP, SCC-SP, ETHERIP, Any-Private-Encryption-Scheme, GMTP, IFMP, PNNI, PIM, ARIS, SCPS, QNX, A/N, IPComp, SNP, Compaq-Pe, IPX-in-IP, VRRP, PGM, Any-0-Hop-Protocol, ENCAP, DDX, IATP, STP, SRP, UTI, SMP, SM, PTP, FIRE, CRTP, CRUDP, SSCOPMCE, IPLT, SPS, PIPE, SCTP, FC, RSVP-E2E-IGNORE, Mobility-Header, UDPLite
protocolNumber Protocol, identified by protocol number, to match against the protocol of an incoming IPv6 packet. Minimum value: 1 Maximum value: 255
icmpType ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol. Minimum value: 0 Maximum value: 65536
icmpCode Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter. Minimum value: 0 Maximum value: 65536
vlan ID of the VLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs. Minimum value: 1 Maximum value: 4094
vxlan ID of the VXLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs. Minimum value: 1 Maximum value: 16777215
interface ID of an interface. The Citrix ADC applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
priority Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created. Minimum value: 1 Maximum value: 81920
logstate Enable or disable logging of events related to the ACL6 rule. The log messages are stored in the configured syslog or auditlog server.
Possible values: ENABLED, DISABLED Default value: DISABLED
ratelimit Maximum number of log messages to be generated per second. If you set this parameter, you must enable the Log State parameter. Default value: 100 Minimum value: 1 Maximum value: 10000
established Allow only incoming TCP packets that have the ACK or RST bit set if the action set for the ACL6 rule is ALLOW and these packets match the other conditions in the ACL6 rule.
dfdhash Specifies the type of hashmethod to be applied, to steer the packet to the FP of the packet.
Possible values: SIP-SPORT-DIP-DPORT, SIP, DIP, SIP-DIP, SIP-SPORT, DIP-DPORT
dfdprefix hashprefix to be applied to SIP/DIP to generate rsshash FP.eg 128 => hash calculated on the complete IP Default value: 128 Minimum value: 1 Maximum value: 128
stateful If stateful option is enabled, transparent sessions are created for the traffic hitting this ACL6 and not hitting any other features like LB, INAT etc.
Possible values: YES, NO Default value: NO
Example
set ns acl6 rule1 -srcPort 50
Related Commands
disable ns acl6
Disables an ACL6 rule. To commit this operation, you must apply the ACL6s.After you apply the ACL6 rules, the Citrix ADC does not compare incoming IPv6 packets to the disabled ACL6 rules.
Synopsis
disable ns acl6
Arguments
acl6name Name of ACL6 rule that you want to disable.
Example
disable ns acl6 rule1
Related Commands
stat ns acl6
Displays statistics related to the ACL6 rules. To display statistics of all the ACL6 rules, run the command without any parameters. To display statistics of a particular ACL6 rule, specify the name of the ACL6 rule.
Synopsis
stat ns acl6 [
Arguments
acl6name Name of the ACL6 rule whose statistics you want the Citrix ADC to display.
detail Specifies detailed output (including more statistics). The output can be quite voluminous. Without this argument, the output will show only a summary.
fullValues Specifies that numbers and strings should be displayed in their full form. Without this option, long strings are shortened and large numbers are abbreviated
ntimes The number of times, in intervals of seven seconds, the statistics should be displayed. Default value: 1 Minimum value: 0
logFile The name of the log file to be used as input.
clearstats Clear the statsistics / counters
Possible values: basic, full
Output
count devno stateflag
Counters
Bridge ACL6 hits (ACL6Bdg) Packets matching a bridge IPv6 ACL, which is in transparent mode and bypasses service processing.
Deny ACL6 hits (ACL6Deny) Packets dropped because they match IPv6 ACLs with processing mode set to DENY.
Allow ACL6 hits (ACL6Allow) Packets matching IPv6 ACLs with processing mode set to ALLOW. Citrix ADC processes these packets.
NAT ACL6 hits (ACL6NAT) Packets matching a NAT ACL6, resulting in a NAT session.
ACL6 hits (ACL6Hits) Packets matching an IPv6 ACL.
ACL6 misses (ACL6Miss) Packets not matching any IPv6 ACL.
NAT64 ACL6 hits (ACL6NAT64) Packets matching a NAT64 ACL6, resulting in a NAT64 translation.
ACL6 Count (ACL6Count) Total number of ACL6 rules configured.
DFD ACL6 Count (dfdACL6Count) Total number of DFD ACL6 rules configured.
DFD ACL6 hits (dfdACL6Hits) Packets matching an dfd ACL6.
DFD ACL6 misses (dfdACL6Miss) Packets not matching any DFD ACL6.
Hits for this ACL6 (Hits) Number of times the acl6 was hit
Example
stat acl6
Related Commands
enable ns acl6
Enables an ACL6 rule. To commit this operation, you must apply the ACL6s.After you apply the ACL6 rules, the Citrix ADC compares incoming IPv6 packets to the enabled ACL6 rules.
Synopsis
enable ns acl6
Arguments
acl6name Name of ACL6 rule that you want to enable.
Example
enable ns acl6 rule1
Related Commands
add ns acl6
Adds an ACL6 rule to the Citrix ADC. To commit this operation, you must apply the ACL6s. ACL6 rules filter data packets on the basis of various parameters, such as IP address, source port, action, and protocol.
Synopsis
add ns acl6
Arguments
acl6name Name for the ACL6 rule. Must begin with an ASCII alphabetic or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters.
acl6action Action to perform on the incoming IPv6 packets that match the ACL6 rule. Available settings function as follows:
- ALLOW - The Citrix ADC processes the packet.
- BRIDGE - The Citrix ADC bridges the packet to the destination without processing it.
- DENY - The Citrix ADC drops the packet.
Possible values: BRIDGE, DENY, ALLOW
td Integer value that uniquely identifies the traffic domain in which you want to configure the entity. If you do not specify an ID, the entity becomes part of the default traffic domain, which has an ID of 0. Minimum value: 0 Maximum value: 4094
srcIPv6 IP address or range of IP addresses to match against the source IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcIPv6Val Source IPv6 address (range).
srcPort Port number or range of port numbers to match against the source port number of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen. For example: 40-90.
Note: The destination port can be specified only for TCP and UDP protocols.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcPortVal Source port (range). Maximum value: 65535
destIPv6 IP address or range of IP addresses to match against the destination IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
destIPv6Val Destination IPv6 address (range).
destPort Port number or range of port numbers to match against the destination port number of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen. For example: 40-90.
Note: The destination port can be specified only for TCP and UDP protocols.
operator Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
destPortVal Destination port (range). Maximum value: 65535
TTL Time to expire this ACL6 (in seconds). Minimum value: 1 Maximum value: 2147483647
srcMac MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value “000000111111”. Default value: “000000000000”
protocol Protocol, identified by protocol name, to match against the protocol of an incoming IPv6 packet.
Possible values: ICMPV6, TCP, UDP, ICMP, IGMP, EGP, IGP, ARGUS, RDP, RSVP, EIGRP, L2TP, ISIS, GGP, IPoverIP, ST, CBT, BBN-RCC-M, NVP-II, PUP, EMCON, XNET, CHAOS, MUX, DCN-MEAS, HMP, PRM, XNS-IDP, TRUNK-1, TRUNK-2, LEAF-1, LEAF-2, IRTP, ISO-TP4, NETBLT, MFE-NSP, MERIT-INP, SEP, 3PC, IDPR, XTP, DDP, IDPR-CMTP, TP++, IL, IPv6, SDRP, IPv6-Route, IPv6-Frag, IDRP, GRE, MHRP, BNA, ESP, AH, I-NLSP, SWIPE, NARP, MOBILE, TLSP, SKIP, IPv6-NoNx, IPv6-Opts, Any-Host-Internal-Protocol, CFTP, Any-Local-Network, SAT-EXPAK, KRYPTOLAN, RVD, IPPC, Any-Distributed-File-System, TFTP, VISA, IPCV, CPNX, CPHB, WSN, PVP, BR-SAT-MO, SUN-ND, WB-MON, WB-EXPAK, ISO-IP, VMTP, SECURE-VM, VINES, TTP, NSFNET-IG, DGP, TCF, OSPFIGP, Sprite-RP, LARP, MTP, AX.25, IPIP, MICP, SCC-SP, ETHERIP, Any-Private-Encryption-Scheme, GMTP, IFMP, PNNI, PIM, ARIS, SCPS, QNX, A/N, IPComp, SNP, Compaq-Pe, IPX-in-IP, VRRP, PGM, Any-0-Hop-Protocol, ENCAP, DDX, IATP, STP, SRP, UTI, SMP, SM, PTP, FIRE, CRTP, CRUDP, SSCOPMCE, IPLT, SPS, PIPE, SCTP, FC, RSVP-E2E-IGNORE, Mobility-Header, UDPLite
protocolNumber Protocol, identified by protocol number, to match against the protocol of an incoming IPv6 packet. Minimum value: 1 Maximum value: 255
vlan ID of the VLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs. Minimum value: 1 Maximum value: 4094
vxlan ID of the VXLAN. The Citrix ADC applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs. Minimum value: 1 Maximum value: 16777215
interface ID of an interface. The Citrix ADC applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
established Allow only incoming TCP packets that have the ACK or RST bit set if the action set for the ACL6 rule is ALLOW and these packets match the other conditions in the ACL6 rule.
icmpType ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol. Minimum value: 0 Maximum value: 65536
icmpCode Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter. Minimum value: 0 Maximum value: 65536
priority Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created. Minimum value: 1 Maximum value: 81920
state State of the ACL6.
Possible values: ENABLED, DISABLED Default value: ENABLED
type Type of the acl6 ,default will be CLASSIC. Available options as follows:
- CLASSIC - specifies the regular extended acls.
- DFD - cluster specific acls,specifies hashmethod for steering of the packet in cluster .
Possible values: CLASSIC, DFD Default value: CLASSIC
dfdhash Specifies the type of hashmethod to be applied, to steer the packet to the FP of the packet.
Possible values: SIP-SPORT-DIP-DPORT, SIP, DIP, SIP-DIP, SIP-SPORT, DIP-DPORT
dfdprefix hashprefix to be applied to SIP/DIP to generate rsshash FP.eg 128 => hash calculated on the complete IP Default value: 128 Minimum value: 1 Maximum value: 128
stateful If stateful option is enabled, transparent sessions are created for the traffic hitting this ACL6 and not hitting any other features like LB, INAT etc.
Possible values: YES, NO Default value: NO
logstate Enable or disable logging of events related to the ACL6 rule. The log messages are stored in the configured syslog or auditlog server.
Possible values: ENABLED, DISABLED Default value: DISABLED
ratelimit Maximum number of log messages to be generated per second. If you set this parameter, you must enable the Log State parameter. Default value: 100 Minimum value: 1 Maximum value: 10000
Example
add ns acl6 rule1 DENY -srcport 45-1024 -destIPv6 2001::45 -protocol TCP
Related Commands
unset ns acl6
Resets the attributes of the specified ACL6 rule. To commit this operation, you must apply the ACL6s.Attributes for which a default value is available revert to their default values. Refer to the set ns acl6 command for descriptions of the parameters..Refer to the set ns acl6 command for meanings of the arguments.
Synopsis
unset ns acl6
Example
unset ns acl6 rule1 -srcPort
Related Commands
rm ns acl6
Removes an ACL6 rule from the Citrix ADC. To commit this operation, you must apply the ACL6s.
Synopsis
rm ns acl6
Arguments
acl6name Name of the ACL6 rule that you want to remove.
Example
rm ns acl6 rule1
Related Commands
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.