Extended ACLs and Extended ACL6s

Extended ACLs and extended ACL6s provide parameters and actions not available with simple ACLs. You can filter data on the basis of parameters such as source IP address, source port, action, and protocol. You can specify tasks to allow a packet, deny a packet, or bridge a packet.

Extended ACLs and ACL6s can be modified after they are created, and you can renumber their priorities to specify the order in which they are evaluated.

Note:If you configure both simple and extended ACLs, simple ACLs take precedence over extended ACLs.

The following actions can be performed on extended ACLs and ACL6s: Modify, Apply, Disable, Enable, Remove, and Renumber (the priority). You can display extended ACLs and ACL6s to verify their configuration, and you can display their statistics.

您可以配置日志细节fo Citrix ADCr packets that match an extended ACL.

Applying Extended ACLs and Extended ACL6s:与简单的acl和ACL6s,扩展acl和交流L6s created on the Citrix ADC do not work until they are applied. Also, if you make any modifications to an extended ACL or ACL6, such as disabling the ACLs, changing a priority, or deleting the ACLs, you must reapply the extended ACLs or ACL6s. You must also reapply them after enabling logging. The procedure to apply extended ACLs or ACL6s reapplies all of them. For example, if you have applied extended ACL rules 1 through 10, and you then create and apply rule 11, the first 10 rules are applied afresh.

If a session has a DENY ACL related to it, that session is terminated when you apply the ACLs.

Extended ACLs and ACL6s are enabled by default. When they are applied, the Citrix ADC starts comparing incoming packets against them. However, if you disable them, they are not used until you reenable them, even if they are reapplied.

Renumbering the priorities of Extended ACLs and Extended ACL6s:Priority numbers determine the order in which extended ACLs or ACL6s are matched against a packet. An ACL with a lower priority number has a higher priority. It is evaluated before ACLs with higher priority numbers (lower priorities), and the first ACL to match the packet determines the action applied to the packet.

When you create an extended ACL or ACL6, the Citrix ADC automatically assigns it a priority number that is a multiple of 10, unless you specify otherwise. For example, if two extended ACLs have priorities of 20 and 30, respectively, and you want a third ACL to have a value between those numbers, you might assign it a value of 25. If you later want to retain the order in which the ACLs are evaluated but restore their numbering to multiples of 10, you can use the renumber procedure.

Configuring Extended ACLs and Extended ACL6s

Configuring an extended ACL or ACL6 on a Citrix ADC consists of the following tasks.

• Create an extended ACL or ACL6.Create an extended ACL or ACL6 to either allow, deny, or bridge a packet. You can specify an IP address or range of IP addresses to match against the source or destination IP addresses of the packets. You can specify a protocol to match against the protocol of incoming packets.
• (Optional)Modify an extended ACL or ACL6. You can modify extended ACLs or ACL6s that you previously created. Or, if you want to temporarily take one out of use you can disable it, and later reenable it.
• Apply extended ACLs or ACL6s. After you create, modify, disable or reenable, or delete an extended ACL or ACL6, you must apply the extended ACLs or ACL6s to activate them.
• (Optional)Renumber the priorities of extended ACLs or ACL6s. If you have configured ACLs with priorities that are not multiples of 10 and want to restore the numbering to multiples of 10, use the renumber procedure.

CLI procedures

To create an extended ACL by using the CLI:

At the command prompt, type:

• add ns acl [-srcIP[] ] [-srcPort[] ] [-destIP[] ] [-destPort[] ] [-TTL] [-srcMac] [(-protocol [-established]) | -protocolNumber] [-vlan] [-interface] [-icmpType [-icmpCode]] [-priority] [-state( ENABLED | DISABLED )] [-logstate( ENABLED | DISABLED ) [-ratelimit]]
• show ns acl[]

Example:

> add ns acl restrict DENY -srcport 45-1024 -destIP 192.168.1.1 -protocol TCP Done 

To create an extended ACL6 by using the CLI:

At the command prompt, type:

• add ns acl6 [-srcIPv6(<操作符>)< srcIPv6Val >] [-srcPort[] ] [-destIPv6[] ] [-destPort[] ] [-TTL] [-srcMac] [(-protocol [-established]) | -protocolNumber] [-vlan] [-interface] [-icmpType [-icmpCode ]] [-priority] [-state( ENABLED | DISABLED )]
• show ns acl6[]

Example:

> add ns acl6 rule6 DENY -srcport 45-1024 -destIPv6 2001::45 -protocol TCP Done 

To modify an extended ACL by using the CLI:

To modify an extended ACL, type theset ns aclcommand, the name of the extended ACL, and the parameters to be changed, with their new values.

To modify an extended ACL6 by using the CLI:

To modify an extended ACL6, type theset ns acl6command, the name of the extended ACL6, and the parameters to be changed, with their new values.

To disable or enable an extended ACL by using the CLI:

At the command prompt, type one of the following commands:

• disable ns acl
• enable ns acl

To disable or enable an extended ACL6 by using the CLI:

At the command prompt, type one of the following commands:

• disable ns acl6
• enable ns acl6

To apply extended ACLs by using the CLI:

At the command prompt, type:

• apply ns acls

To apply extended ACL6s by using the CLI:

At the command prompt, type:

• apply ns acls6

To renumber the priorities of extended ACLs by using the CLI:

At the command prompt, type:

• renumber ns acls

To renumber the priorities of extended ACL6s by using the CLI:

At the command prompt, type:

• renumber ns acls6

GUI procedures

To configure an extended ACL by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACLstab, add a new extended ACL or edit an existing extended ACL. To enable or disable an existing extended ACL, select it, and then selectEnableorDisablefrom theActionlist.

To configure an extended ACL6s by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACL6stab, add a new extended ACL6 or edit an existing extended ACL6. To enable or disable an existing extended ACL6, select it, and then selectEnableorDisablefrom theActionlist.

To apply extended ACLs by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACLstab, in theActionlist, clickApply.

To apply extended ACL6s by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACL6stab, in theActionlist, clickApply.

To renumber the priorities of extended ACLs by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACLstab, in theActionlist, clickRenumber Priority (s).

To renumber the priorities of extended ACL6s by using the GUI:

Navigate toSystem>Network>ACLsand, on theExtended ACL6stab, in theActionlist, clickRenumber Priority (s).

Sample Configurations

The following table shows examples of configuring extended ACL rules through the command line interface:ACLs sample configurations.

Logging Extended ACLs

您可以配置日志细节fo Citrix ADCr packets that match extended ACLs.

Note:You cannot enable logging for extended ACL6s.

In addition to the ACL name, the logged details include packet-specific information such as the source and destination IP addresses. The information is stored either in the syslog file or in the nslog file, depending on the type of global logging (syslog or nslog) enabled.

Logging must be enabled at both the global level and the ACL level. The global setting takes precedence. For more information about enabling logging globally, see “.”

To optimize logging, when multiple packets from the same flow match an ACL, only the first packet’s details are logged, and the counter is incremented for every packet that belongs to the same flow. A flow is defined as a set of packets that have the same values for the source IP address, destination IP address, source port, destination port, and protocol parameters. To avoid flooding of log messages, the Citrix ADC performs internal rate limiting so that packets belonging to the same flow are not repeatedly logged. The total number of different flows that can be logged at any given time is limited to 10,000.

Note:You must apply ACLs after you enable logging.

CLI procedures

To configure extended ACL Logging by using the CLI:

At the command prompt, type the following commands to configure logging and verify the configuration:

• set ns acl [-logState(ENABLED | DISABLED)] [-rateLimit]
• show ns acl[]

Example:

> set ns acl restrict -logstate ENABLED -ratelimit 120 Warning: ACL modified, apply ACLs to activate change 

GUI procedures

To configure extended ACL Logging by using the GUI:

1. Navigate to System > Network > ACLs and, on theExtended ACLstab, open the extended ACL.
2. Set the following parameters:
   • Log State—Enable or disable logging of events related to the extended ACL rule. The log messages are stored in the configured syslog or auditlog server.
   • Log Rate Limit—Maximum number of log messages to be generated per second. If you set this parameter, you must enable the Log State parameter.

Extended ACL6 Logging

You can configure the Citrix ADC appliance to log details for packets that match an extended ACL6 rule. In addition to the ACL6 name, the logged details include packet-specific information, such as the source and destination IP addresses. The information is stored either in a syslog or nslog file, depending on the type of logging (syslog or nslog) that you have configured in the Citrix ADC appliance.

To optimize logging, when multiple packets from the same flow match an ACL6, only the first packet’s details are logged. The counter is incremented for every other packet that belongs to the same flow. A flow is defined as a set of packets that have the same values for the following parameters:

• Source IP
• Destination IP
• Source port
• Destination port
• Protocol (TCP or UDP)

If an incoming packet is not from the same flow, a new flow is created. The total number of different flows that can be logged at any given time is limited to 10,000.

CLI procedures

To configure logging for an extended ACl6 rule by using the CLI:

• To configure logging while adding the extended ACL6 rule, at the command prompt, type:
  • add acl6 [-logState(ENABLED|DISABLED)] [-rateLimit]
  • show acl6[]
  • apply acls6

• To configure logging for an existing extended ACL6 rule, at the command prompt, type:
  • set acl6 [-logState(ENABLED|DISABLED)] [-rateLimit]
  • show acl6[]
  • apply acls6

GUI procedures

To configure extended ACL6 Logging by using the GUI:

1. Navigate toSystem>Network>ACLsand, then click theExtended ACL6stab.
2. Set the following parameters while adding, or modifying an existing extended ACL6 rule.
   • Log State—Enable or disable logging of events related to the extended ACL6s rule. The log messages are stored in the configured syslog or auditlog server.
   • Log Rate Limit—Maximum number of log messages to be generated per second. If you set this parameter, you must enable theLog Stateparameter.

Example:

> set acl6 ACL6-1 -logstate ENABLED -ratelimit 120 Done > apply acls6 Done 

Displaying Extended ACL and Extended ACL6s Statistics

你能说play statistics of extended ACLs and ACL6s.

The following table lists the statistics associated with extended ACLs and ACL6s, and their descriptions.

CLI procedures

To display the statistics of all extended ACLs by using the CLI:

At the command prompt, type:

• stat ns acl

To display the statistics of all extended ACL6s by using the CLI:

At the command prompt, type:

• stat ns acl6

GUI procedures

To display the statistics of an extended ACL by using the GUI:

Navigate to System > Network > ACLs, on theExtended ACLstab, select the extended ACL, and clickStatistics.

To display the statistics of an extended ACL6 by using the GUI:

Navigate to System > Network > ACLs, on theExtended ACL6stab, select the extended ACL, and clickStatistics.

Stateful ACLs

A stateful ACL rule creates a session when a request matches the rule and allows the resulting responses even if these responses matches a deny ACL rule in Citrix ADC appliance. A stateful ACL offloads the work of creating additional ACL rules/forwarding session rules for allowing these specific responses.

Stateful ACLs can be best used in an edge firewall deployment of a Citrix ADC appliance having the following requirements:

• The Citrix ADC appliance must allow requests initiated from internal clients and the related responses from the Internet.
• 设备必须从国际米兰将数据包net that are not related to any client connections.

Before you begin

Before you configure stateful ACL rules, note the following points:

• The Citrix ADC appliance supports stateful ACL rules as well as stateful ACL6 rules.
• In a high availability setup, the sessions for a stateful ACL rule are not synchronized to the secondary node.
• You cannot configure an ACL rule as stateful if the rule is bound to any Citrix ADC NAT configuration. Some examples of Citrix ADC NAT configurations are:
  • RNAT
  • Large Scale NAT (large scale NAT44, DS-Lite, large scale NAT64)
  • NAT64
  • Forwarding session
• You cannot configure an ACL rule as stateful if TTL and Established parameters are set for this ACL rule.
• The sessions created for a stateful ACL rule continue to exist till timeout irrespective of the following ACL operations:
  • Remove ACL
  • Disable ACL
  • Clear ACL
• Stateful ACLs are not supported for the following protocols:
  • Active FTP
  • TFTP

Configure stateful IPv4 ACL rules

Configuring a stateful ACL rule consists of enabling the stateful parameter of an ACL rule.

To enable the stateful parameter of an ACL rule by using the CLI:

• To enable the stateful parameter while adding an ACL rule, at the command prompt, type:
  • add acl ALLOW -stateful (ENABLED|DISABLED)
  • apply acls
  • show acl

• To enable the stateful parameter of an existing ACL rule, at the command prompt, type:
  • set acl -stateful(ENABLED|DISABLED)
  • apply acls
  • show acl

To enable the stateful parameter of an ACL rule by using the CLI:

1. Navigate toSystem>Network>ACLsand, on theExtended ACLstab.
2. Enable theStatefulparameter while adding, or modifying an existing ACL rule.

> add acl ACL-1 allow -srciP 1.1.1.1 -stateful Yes Done > apply acls Done > show acl 1) Name: ACL-1 Action: ALLOW Hits: 0 srcIP = 1.1.1.1 destIP srcMac: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 NAT: NO TTL: Log Status: DISABLED Forward Session: NO Stateful: YES 

Configure stateful ACL6 rules

Configuring a stateful ACL6 rule consists of enabling the stateful parameter of an ACL6 rule.

To enable the stateful parameter of an ACL6 rule by using the CLI:

• To enable the stateful parameter while adding an ACL6 rule, at the command prompt, type:
  • add acl6 ALLOW -stateful(ENABLED|DISABLD)
  • apply acls6
  • show acl6

• To enable the stateful parameter of an existing ACL6 rule, at the command prompt, type:
  • set acl6 -stateful(ENABLED|DISABLED)
  • apply acls6
  • show acl6

To enable the stateful parameter of an ACL6 rule by using the CLI:

1. Navigate toSystem>Network>ACLsand, on theExtended ACL6stab.
2. Enable theStatefulparameter while adding, or modifying an existing ACL6 rule.

> add acl6 ACL6-1 allow -srcipv6 1000::1 –stateful Yes Done > apply acls6 Done > show acl6 1) Name: ACL6-1 Action: ALLOW Hits: 0 srcIPv6 = 1000::1 destIPv6 srcMac: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 NAT: NO TTL: Forward Session: NO Stateful: YES