Extended ACLs and Extended ACL6s
Extended ACLs and extended ACL6s provide parameters and actions not available with simple ACLs. You can filter data on the basis of parameters such as source IP address, source port, action, and protocol. You can specify tasks to allow a packet, deny a packet, or bridge a packet.
Extended ACLs and ACL6s can be modified after they are created, and you can renumber their priorities to specify the order in which they are evaluated.
Note: If you configure both simple and extended ACLs, simple ACLs take precedence over extended ACLs.
The following actions can be performed on extended ACLs and ACL6s: Modify, Apply, Disable, Enable, Remove, and Renumber (the priority). You can display extended ACLs and ACL6s to verify their configuration, and you can display their statistics.
You can configure the Citrix ADC to log details for packets that match an extended ACL.
Applying Extended ACLs and Extended ACL6s: Unlike simple ACLs and ACL6s, extended ACLs and ACL6s created on the Citrix ADC do not work until they are applied. Also, if you make any modifications to an extended ACL or ACL6, such as disabling the ACLs, changing a priority, or deleting the ACLs, you must reapply the extended ACLs or ACL6s. You must also reapply them after enabling logging. The procedure to apply extended ACLs or ACL6s reapplies all of them. For example, if you have applied extended ACL rules 1 through 10, and you then create and apply rule 11, the first 10 rules are applied afresh.
If a session has a DENY ACL related to it, that session is terminated when you apply the ACLs.
Extended ACLs and ACL6s are enabled by default. When they are applied, the Citrix ADC starts comparing incoming packets against them. However, if you disable them, they are not used until you reenable them, even if they are reapplied.
Renumbering the priorities of Extended ACLs and Extended ACL6s: Priority numbers determine the order in which extended ACLs or ACL6s are matched against a packet. An ACL with a lower priority number has a higher priority. It is evaluated before ACLs with higher priority numbers (lower priorities), and the first ACL to match the packet determines the action applied to the packet.
When you create an extended ACL or ACL6, the Citrix ADC automatically assigns it a priority number that is a multiple of 10, unless you specify otherwise. For example, if two extended ACLs have priorities of 20 and 30, respectively, and you want a third ACL to have a value between those numbers, you might assign it a value of 25. If you later want to retain the order in which the ACLs are evaluated but restore their numbering to multiples of 10, you can use the renumber procedure.
Configuring Extended ACLs and Extended ACL6s
Configuring an extended ACL or ACL6 on a Citrix ADC consists of the following tasks.
- Create an extended ACL or ACL6. Create an extended ACL or ACL6 to either allow, deny, or bridge a packet. You can specify an IP address or range of IP addresses to match against the source or destination IP addresses of the packets. You can specify a protocol to match against the protocol of incoming packets.
- (Optional) Modify an extended ACL or ACL6. You can modify extended ACLs or ACL6s that you previously created. Or, if you want to temporarily take one out of use you can disable it, and later reenable it.
- Apply extended ACLs or ACL6s. After you create, modify, disable or reenable, or delete an extended ACL or ACL6, you must apply the extended ACLs or ACL6s to activate them.
- (Optional) Renumber the priorities of extended ACLs or ACL6s. If you have configured ACLs with priorities that are not multiples of 10 and want to restore the numbering to multiples of 10, use the renumber procedure.
CLI procedures
To create an extended ACL by using the CLI:
At the command prompt, type:
- **add ns acl** <aclname> <aclaction> [-**srcIP** [<operator>] <srcIPVal>] [-**srcPort** [<operator>] <srcPortVal>] [-**destIP** [<operator>] <destIPVal>] [-**destPort** [<operator>] <destPortVal>] [-**TTL** <positive_integer>] [-**srcMac** <mac_addr>] [(-**protocol** <protocol> [-established]) | -**protocolNumber** <positive_integer>] [-**vlan** <positive_integer>] [-**interface** <interface_name>] [-**icmpType** <positive_integer> [-**icmpCode** <positive_integer>]] [-**priority** <positive_integer>] [-**state** ( ENABLED | DISABLED )] [-**logstate** ( ENABLED | DISABLED ) [-**ratelimit** <positive_integer>]]
- show ns acl [<aclName>]
Example:
> add ns acl restrict DENY -srcport 45-1024 -destIP 192.168.1.1 -protocol TCP
Done
<!--NeedCopy-->
To create an extended ACL6 by using the CLI:
At the command prompt, type:
- **add ns acl6** <acl6name> <acl6action> [-**srcIPv6** [<operator>] <srcIPv6Val>] [-**srcPort** [<operator>] <srcPortVal>] [-**destIPv6** [<operator>] <destIPv6Val>] [-**destPort** [<operator>] <destPortVal>] [-**TTL** <positive_integer>] [-**srcMac** <mac_addr>] [(-**protocol** <protocol> [-established]) | -**protocolNumber** <positive_integer>] [-**vlan** <positive_integer>] [-**interface** <interface_name>] [-**icmpType** <positive_integer> [-icmpCode <positive_integer>]] [-**priority** <positive_integer>] [-**state** ( ENABLED | DISABLED )]
- show ns acl6 [<aclName>]
Example:
> add ns acl6 rule6 DENY -srcport 45-1024 -destIPv6 2001::45 -protocol TCP
Done
<!--NeedCopy-->
To modify an extended ACL by using the CLI:
To modify an extended ACL, type the set ns acl command, the name of the extended ACL, and the parameters to be changed, with their new values.
To modify an extended ACL6 by using the CLI:
To modify an extended ACL6, type the set ns acl6 command, the name of the extended ACL6, and the parameters to be changed, with their new values.
To disable or enable an extended ACL by using the CLI:
At the command prompt, type one of the following commands:
- disable ns acl <aclname>
- enable ns acl <aclname>
To disable or enable an extended ACL6 by using the CLI:
At the command prompt, type one of the following commands:
- disable ns acl6 <aclname>
- enable ns acl6<aclname>
To apply extended ACLs by using the CLI:
At the command prompt, type:
- apply ns acls
To apply extended ACL6s by using the CLI:
At the command prompt, type:
- apply ns acls6
To renumber the priorities of extended ACLs by using the CLI:
At the command prompt, type:
- renumber ns acls
To renumber the priorities of extended ACL6s by using the CLI:
At the command prompt, type:
- renumber ns acls6
GUI procedures
To configure an extended ACL by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACLs tab, add a new extended ACL or edit an existing extended ACL. To enable or disable an existing extended ACL, select it, and then select Enable or Disable from the Action list.
To configure an extended ACL6s by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACL6s tab, add a new extended ACL6 or edit an existing extended ACL6. To enable or disable an existing extended ACL6, select it, and then select Enable or Disable from the Action list.
To apply extended ACLs by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACLs tab, in the Action list, click Apply.
To apply extended ACL6s by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACL6s tab, in the Action list, click Apply.
To renumber the priorities of extended ACLs by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACLs tab, in the Action list, click Renumber Priority (s).
To renumber the priorities of extended ACL6s by using the GUI:
Navigate to System > Network > ACLs and, on the Extended ACL6s tab, in the Action list, click Renumber Priority (s).
Sample Configurations
The following table shows examples of configuring extended ACL rules through the command line interface: ACLs sample configurations.
Logging Extended ACLs
You can configure the Citrix ADC to log details for packets that match extended ACLs.
Note: You cannot enable logging for extended ACL6s.
In addition to the ACL name, the logged details include packet-specific information such as the source and destination IP addresses. The information is stored either in the syslog file or in the nslog file, depending on the type of global logging (syslog or nslog) enabled.
Logging must be enabled at both the global level and the ACL level. The global setting takes precedence. For more information about enabling logging globally, see “.”
To optimize logging, when multiple packets from the same flow match an ACL, only the first packet’s details are logged, and the counter is incremented for every packet that belongs to the same flow. A flow is defined as a set of packets that have the same values for the source IP address, destination IP address, source port, destination port, and protocol parameters. To avoid flooding of log messages, the Citrix ADC performs internal rate limiting so that packets belonging to the same flow are not repeatedly logged. The total number of different flows that can be logged at any given time is limited to 10,000.
Note: You must apply ACLs after you enable logging.
CLI procedures
To configure extended ACL Logging by using the CLI:
At the command prompt, type the following commands to configure logging and verify the configuration:
- **set ns acl** <aclName> [-**logState** (ENABLED | DISABLED)] [-**rateLimit** <positive_integer>]
- show ns acl [<aclName>]
Example:
> set ns acl restrict -logstate ENABLED -ratelimit 120
Warning: ACL modified, apply ACLs to activate change
<!--NeedCopy-->
GUI procedures
To configure extended ACL Logging by using the GUI:
- Navigate to System > Network > ACLs and, on the Extended ACLs tab, open the extended ACL.
- Set the following parameters:
- Log State—Enable or disable logging of events related to the extended ACL rule. The log messages are stored in the configured syslog or auditlog server.
- Log Rate Limit—Maximum number of log messages to be generated per second. If you set this parameter, you must enable the Log State parameter.
Extended ACL6 Logging
You can configure the Citrix ADC appliance to log details for packets that match an extended ACL6 rule. In addition to the ACL6 name, the logged details include packet-specific information, such as the source and destination IP addresses. The information is stored either in a syslog or nslog file, depending on the type of logging (syslog or nslog) that you have configured in the Citrix ADC appliance.
To optimize logging, when multiple packets from the same flow match an ACL6, only the first packet’s details are logged. The counter is incremented for every other packet that belongs to the same flow. A flow is defined as a set of packets that have the same values for the following parameters:
- Source IP
- Destination IP
- Source port
- Destination port
- Protocol (TCP or UDP)
If an incoming packet is not from the same flow, a new flow is created. The total number of different flows that can be logged at any given time is limited to 10,000.
CLI procedures
To configure logging for an extended ACl6 rule by using the CLI:
- To configure logging while adding the extended ACL6 rule, at the command prompt, type:
- **add acl6** <acl6Name> <acl6action> [-**logState** (**ENABLED** | **DISABLED**)] [-**rateLimit** <positive_integer>]
- show acl6 [<acl6Name>]
- apply acls6
- To configure logging for an existing extended ACL6 rule, at the command prompt, type:
- **set acl6** <acl6Name> [-**logState** (**ENABLED** | **DISABLED**)] [-**rateLimit** <positive_integer>]
- show acl6 [<acl6Name>]
- apply acls6
GUI procedures
To configure extended ACL6 Logging by using the GUI:
- Navigate to System > Network > ACLs and, then click the Extended ACL6s tab.
- Set the following parameters while adding, or modifying an existing extended ACL6 rule.
- Log State—Enable or disable logging of events related to the extended ACL6s rule. The log messages are stored in the configured syslog or auditlog server.
- Log Rate Limit—Maximum number of log messages to be generated per second. If you set this parameter, you must enable the Log State parameter.
Example:
> set acl6 ACL6-1 -logstate ENABLED -ratelimit 120
Done
> apply acls6
Done
<!--NeedCopy-->
Displaying Extended ACL and Extended ACL6s Statistics
You can display statistics of extended ACLs and ACL6s.
The following table lists the statistics associated with extended ACLs and ACL6s, and their descriptions.
| Statistic | Specifies |
| Allow ACL hits | Packets matching ACLs with processing mode set to ALLOW. The Citrix ADC processes these packets. |
| NAT ACL hits | Packets matching a NAT ACL, resulting in a NAT session. |
| Deny ACL hits | Packets dropped because they match ACLs with processing mode set to DENY. |
| Bridge ACL hits | Packets matching a bridge ACL, which in transparent mode bypasses service processing. |
| ACL hits | Packets matching an ACL. |
| ACL misses | Packets not matching any ACL. |
CLI procedures
To display the statistics of all extended ACLs by using the CLI:
At the command prompt, type:
- stat ns acl
To display the statistics of all extended ACL6s by using the CLI:
At the command prompt, type:
- stat ns acl6
GUI procedures
To display the statistics of an extended ACL by using the GUI:
Navigate to System > Network > ACLs, on the Extended ACLs tab, select the extended ACL, and click Statistics.
To display the statistics of an extended ACL6 by using the GUI:
Navigate to System > Network > ACLs, on the Extended ACL6s tab, select the extended ACL, and click Statistics.
Stateful ACLs
A stateful ACL rule creates a session when a request matches the rule and allows the resulting responses even if these responses matches a deny ACL rule in Citrix ADC appliance. A stateful ACL offloads the work of creating additional ACL rules/forwarding session rules for allowing these specific responses.
Stateful ACLs can be best used in an edge firewall deployment of a Citrix ADC appliance having the following requirements:
- The Citrix ADC appliance must allow requests initiated from internal clients and the related responses from the Internet.
- The appliance must drop the packets from the Internet that are not related to any client connections.
Before you begin
Before you configure stateful ACL rules, note the following points:
- The Citrix ADC appliance supports stateful ACL rules as well as stateful ACL6 rules.
- In a high availability setup, the sessions for a stateful ACL rule are not synchronized to the secondary node.
- You cannot configure an ACL rule as stateful if the rule is bound to any Citrix ADC NAT configuration. Some examples of Citrix ADC NAT configurations are:
- RNAT
- Large Scale NAT (large scale NAT44, DS-Lite, large scale NAT64)
- NAT64
- Forwarding session
- You cannot configure an ACL rule as stateful if TTL and Established parameters are set for this ACL rule.
- The sessions created for a stateful ACL rule continue to exist till timeout irrespective of the following ACL operations:
- Remove ACL
- Disable ACL
- Clear ACL
- Stateful ACLs are not supported for the following protocols:
- Active FTP
- TFTP
Configure stateful IPv4 ACL rules
Configuring a stateful ACL rule consists of enabling the stateful parameter of an ACL rule.
To enable the stateful parameter of an ACL rule by using the CLI:
- To enable the stateful parameter while adding an ACL rule, at the command prompt, type:
- add acl <lname> ALLOW -stateful ( **ENABLED** | **DISABLED** )
- apply acls
- show acl <name>
- To enable the stateful parameter of an existing ACL rule, at the command prompt, type:
- set acl <name> -**stateful** ( **ENABLED** | **DISABLED** )
- apply acls
- show acl <name>
To enable the stateful parameter of an ACL rule by using the CLI:
- Navigate to System > Network > ACLs and, on the Extended ACLs tab.
- Enable the Stateful parameter while adding, or modifying an existing ACL rule.
> add acl ACL-1 allow -srciP 1.1.1.1 -stateful Yes
Done
> apply acls
Done
> show acl
1) Name: ACL-1
Action: ALLOW Hits: 0
srcIP = 1.1.1.1
destIP
srcMac:
Protocol:
Vlan: Interface:
Active Status: ENABLED Applied Status: NOTAPPLIED
Priority: 10 NAT: NO
TTL:
Log Status: DISABLED
Forward Session: NO
Stateful: YES
<!--NeedCopy-->
Configure stateful ACL6 rules
Configuring a stateful ACL6 rule consists of enabling the stateful parameter of an ACL6 rule.
To enable the stateful parameter of an ACL6 rule by using the CLI:
- To enable the stateful parameter while adding an ACL6 rule, at the command prompt, type:
- add acl6 <name> ALLOW -**stateful** ( **ENABLED** | **DISABLD** )
- apply acls6
- show acl6 <name>
- To enable the stateful parameter of an existing ACL6 rule, at the command prompt, type:
- set acl6 <name> -**stateful** ( **ENABLED** | **DISABLED** )
- apply acls6
- show acl6 <name>
To enable the stateful parameter of an ACL6 rule by using the CLI:
- Navigate to System > Network > ACLs and, on the Extended ACL6s tab.
- Enable the Stateful parameter while adding, or modifying an existing ACL6 rule.
> add acl6 ACL6-1 allow -srcipv6 1000::1 –stateful Yes
Done
> apply acls6
Done
> show acl6
1) Name: ACL6-1
Action: ALLOW Hits: 0
srcIPv6 = 1000::1
destIPv6
srcMac:
Protocol:
Vlan: Interface:
Active Status: ENABLED Applied Status: NOTAPPLIED
Priority: 10 NAT: NO
TTL:
Forward Session: NO
Stateful: YES
<!--NeedCopy-->