ADC CLI Commands

ns-simpleacl

May 28, 2024

Contributed by:

The following operations can be performed on “ns-simpleacl”:

add ns simpleacl

Adds a simple ACL rule to the Citrix ADC. Simple ACL rules filter IPv4 packets on the basis of their source IP addresses and, optionally, the destination port and/or protocol. Any packet with the characteristics specified in the simple ACL rule is dropped.

Synopsis

add ns simpleacl \[-td <positive\_integer>] -srcIP <ip\_addr> \[-destPort -protocol \( TCP | UDP )] \[-TTL <positive\_integer>]

Arguments

aclname Name for the simple ACL rule. Must begin with an ASCII alphabetic or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the simple ACL rule is created.

aclaction Drop incoming IPv4 packets that match the simple ACL rule.

Possible values: DENY

td Integer value that uniquely identifies the traffic domain in which you want to configure the entity. If you do not specify an ID, the entity becomes part of the default traffic domain, which has an ID of 0. Minimum value: 0 Maximum value: 4094

srcIP IP address to match against the source IP address of an incoming IPv4 packet.

destPort Port number to match against the destination port number of an incoming IPv4 packet.

DestPort is mandatory while setting Protocol. Omitting the port number and protocol creates an all-ports and all protocols simple ACL rule, which matches any port and any protocol. In that case, you cannot create another simple ACL rule specifying a specific port and the same source IPv4 address. Minimum value: 1 Maximum value: 65535

protocol Protocol to match against the protocol of an incoming IPv4 packet. You must set this parameter if you have set the Destination Port parameter.

Possible values: TCP, UDP

TTL Number of seconds, in multiples of four, after which the simple ACL rule expires. If you do not want the simple ACL rule to expire, do not specify a TTL value. Minimum value: 4 Maximum value: 2147483647

Example

add simpleacl rule1 DENY -srcIP 1.1.1.1 -destPort 80 -protocol TCP add simpleacl rule2 DENY -srcIP 2.2.2.2 -TTL 600

stat ns simpleacl

Displays statistics related to the simple ACL rules.

Synopsis

stat ns simpleacl [-detail] [-fullValues] [-ntimes ] [-logFile ] [-clearstats ( basic

full )]

Arguments

detail Specifies detailed output (including more statistics). The output can be quite voluminous. Without this argument, the output will show only a summary.

fullValues Specifies that numbers and strings should be displayed in their full form. Without this option, long strings are shortened and large numbers are abbreviated

ntimes The number of times, in intervals of seven seconds, the statistics should be displayed. Default value: 1 Minimum value: 0

logFile The name of the log file to be used as input.

clearstats Clear the statsistics / counters

Possible values: basic, full

Output

Counters

SimpleACL hits (SACLHits) Packets matching a SimpleACL.

SimpleACL misses (SACLMiss) Packets not matching any SimpleACL.

SimpleACLs count (SACLsCount) Number of SimpleACLs configured.

Allow SimpleACL hits (SACLAllow) Total packets that matched a SimpleACL with action ALLOW and got consumed by Citrix ADC.

Bridge SimpleACL hits (SACLBdg) Total packets that matched a SimpleACL with action BRIDGE and got bridged by Citrix ADC.

Deny SimpleACL hits (SACLDeny) Packets dropped because they match SimpleACL (Access Control List) with processing mode set to DENY.

Example

stat simpleacl

stat ns partition

clear ns simpleacl

Removes all simple ACL rules from the Citrix ADC.

Synopsis

clear ns simpleacl

show ns simpleacl

Displays settings of all the simple ACL rules or of the specified simple ACL rule. To display settings of all the simple ACL rules, run the command without any parameters. To display settings of a particular simple ACL rule, specify the name of the simple ACL rule.

Synopsis

show ns simpleacl []

Arguments

aclname Name of the simple ACL rule whose details you want the Citrix ADC to display.

Output

aclaction Drop incoming IPv4 packets that match the simple ACL rule.

srcIP Source IP address.

stateflag SACL state flag.

destPort Destination Port.

protocol Protocol associated with the ACL rule.

TTL Time to expire this ACL rule(in seconds).

time Time when this acl is added.

hits Number of hits for this ACL rule.

devno count

Example

show simpleacl rule1 Name: rule1 Action: DENY srcIP = 10.102.1.150 Protocol = TCP DestPort = 110 Hits: 5 TTL: 200(seconds)

flush ns simpleacl

Terminates all established IPv4 connections that match any of the newly configured simple ACL rules.

Note: If you plan to create more than one simple ACL rule and flush existing connections that match any of them, you can minimize the affect on performance by first creating all of the simple ACL rules and then running flush only once.

Synopsis

flush ns simpleacl -estSessions

Arguments

estSessions

rm ns simpleacl

Removes a simple ACL rule from the Citrix ADC.

Synopsis

rm ns simpleacl ...

Arguments

aclname Name of the simple ACL rule that you want to remove.

Example

rm ns simpleacl rule1

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

ns-simpleacl

May 28, 2024

Contributed by:

May 28, 2024

Contributed by:

ns-simpleacl

add ns simpleacl

Synopsis

Arguments

Example

stat ns simpleacl

Synopsis

Arguments

Output

Counters

Example

Related Commands

clear ns simpleacl

Synopsis

show ns simpleacl

Synopsis

Arguments

Output

Example

flush ns simpleacl

Synopsis

Arguments

rm ns simpleacl

Synopsis

Arguments

Example

In this article