ADC

Packet forwarding modes

March 10, 2022

Contributed by:

C S

The Citrix ADC appliance can either route or bridge packets that are not destined for an IP address owned by the appliance (that is, the IP address is not the NSIP, a MIP, a SNIP, a configured service, or a configured virtual server). By default, L3 mode (routing) is enabled and L2 mode (bridging) is disabled, but you can change the configuration. The following flow chart shows how the appliance evaluates packets and either processes, routes, bridges, or drops them.

Figure 1. Interaction between Layer 2 and Layer 3 Modes

Network interaction between layer2 and layer3

An appliance can use the following modes to forward the packets it receives:

Layer 2 (L2) Mode
Layer 3 (L3) Mode
MAC-Based Forwarding Mode

Enable and disable layer 2 mode

Layer 2 mode controls the Layer 2 forwarding (bridging) function. You can use this mode to configure a Citrix ADC appliance to behave as a Layer 2 device and bridge the packets that are not destined for it. When this mode is enabled, packets are not forwarded to any of the MAC addresses, because the packets can arrive on any interface of the appliance and each interface has its own MAC address.

With Layer 2 mode disabled (which is the default), the appliance drops packets that are not destined for one of its MAC address. If another Layer 2 device is installed in parallel with the appliance, Layer 2 mode must be disabled to prevent bridging (Layer 2) loops. You can use the configuration utility or the command line to enable Layer 2 mode.

Note: The appliance does not support the Spanning Tree Protocol. To avoid loops, if you enable L2 mode, do not connect two interfaces on the appliance to the same broadcast domain.

To enable or disable Layer 2 mode by using the CLI

At the command prompt, type the following commands to enable/disable Layer 2 mode and verify that it has been enabled/disabled:

enable ns mode <Mode>
disable ns mode <Mode>
show ns mode

Examples

    > enable ns mode l2
    Done
    > show ns mode

    Mode Acronym Status
    ------- ------- ------
    1) Fast Ramp FR ON
    2) Layer 2 mode L2 ON
    .
    .
    .
    Done
    >

    > disable ns mode l2
    Done
    > show ns mode

    Mode Acronym Status
    ------- ------- ------
    1) Fast Ramp FR ON
    2) Layer 2 mode L2 OFF
    .
    .
    .
    Done
    >
<!--NeedCopy-->

To enable or disable Layer 2 mode by using the GUI

In the navigation pane, expand System, and then click Settings.
In the details pane, under Modes and Features, click Configure modes.
In the Configure Modes dialog box, to enable Layer 2 mode, select the Layer 2 Mode check box. To disable Layer 2 mode, clear the check box.
Click OK. The Enable/Disable Mode(s)? message appears in the details pane.
Click Yes.

Enable and disable layer 3 mode

Layer 3 mode controls the Layer 3 forwarding function. You can use this mode to configure a Citrix ADC appliance to look at its routing table and forward packets that are not destined for it. With Layer 3 mode enabled (which is the default), the appliance performs route table lookups and forwards all packets that are not destined for any appliance-owned IP address. If you disable Layer 3 mode, the appliance drops these packets.

Enable or disable Layer 3 mode by using the CLI

At the command prompt, type the following commands to enable/disable Layer 3 mode and verify that it has been enabled/disabled:

enable ns mode <Mode>
disable ns mode <Mode>
show ns mode

Examples

    > enable ns mode l3
    Done
    > show ns mode

    Mode Acronym Status
    ------- ------- ------
    1) Fast Ramp FR ON
    2) Layer 2 mode L2 OFF
    .
    .
    .
    9) Layer 3 mode (ip forwarding) L3 ON
    .
    .
    .
    Done
    >

    > disable ns mode l3
    Done
    > show ns mode

    Mode Acronym Status
    ------- ------- ------
    1) Fast Ramp FR ON
    2) Layer 2 mode L2 OFF
    .
    .
    .
    9) Layer 3 mode (ip forwarding) L3 OFF
    .
    .
    .
    Done
    >
<!--NeedCopy-->

Enable or disable Layer 3 mode by using the GUI

In the navigation pane, expand System, and then click Settings.
In the details pane, under Modes and Features, click Configure modes.
In the Configure Modes dialog box, to enable Layer 3 mode, select the Layer 3 Mode (IP Forwarding) check box. To disable Layer 3 mode, clear the check box.
Click OK. The Enable/Disable Mode(s)? message appears in the details pane.
Click Yes.

Enable and disable MAC-based forwarding mode

You can use MAC-based forwarding to process traffic more efficiently and avoid multiple-route or ARP lookups when forwarding packets, because the Citrix ADC appliance remembers the MAC address of the source. To avoid multiple lookups, the appliance caches the source MAC address of every connection for which it performs an ARP lookup, and it returns the data to the same MAC address.

MAC-based forwarding is useful when you use VPN devices because the appliance ensures that all traffic flowing through a particular VPN passes through the same VPN device.

The following figure shows the process of MAC-based forwarding.

Figure 2. MAC-based Forwarding Process

Working MAC-based forwarding

When MAC-based forwarding is enabled, the appliance caches the MAC address of:

The source (a transmitting device such as router, firewall, or VPN device) of the inbound connection.
The server that responds to the requests.

When a server responds through an appliance, the appliance sets the destination MAC address of the response packet to the cached address, ensuring that the traffic flows in a symmetric manner, and then forwards the response to the client. The process bypasses the route table lookup and ARP lookup functions. However, when an appliance initiates a connection, it uses the route and ARP tables for the lookup function. To enable MAC-based forwarding, use the configuration utility or the command line.

Some deployments require the incoming and outgoing paths to flow through different routers. In these situations, MAC-based forwarding breaks the topology design. For a global server load balancing (GSLB) site that requires the incoming and outgoing paths to flow through different routers, you must disable MAC-based forwarding and use the appliance’s default router as the outgoing router.

With MAC-based forwarding disabled and Layer 2 or Layer 3 connectivity enabled, a route table can specify separate routers for outgoing and incoming connections. To disable MAC-based forwarding, use the configuration utility or the command line.

Enable or disable MAC-based forwarding by using the CLI

At the command prompt, type the following commands to enable/disable MAC-based forwarding mode and verify that it has been enabled/disabled:

<enable ns mode <Mode>
<disable ns mode <Mode>

<show ns mode Example

``` pre codeblock

enable ns mode mbf Done show ns mode

  Mode                        Acronym           Status
  -------                     -------           ------   1)  Fast Ramp                   FR                ON   2)  Layer 2 mode                L2                OFF   .   .   .   6)  MAC-based forwarding        MBF               ON   .   .   .   Done  >

disable ns mode mbf Done show ns mode

  Mode                        Acronym           Status
  -------                     -------           ------   1)  Fast Ramp                   FR                ON   2)  Layer 2 mode                L2                OFF   .   .   .   6)  MAC-based forwarding        MBF               OFF   .   .   .   Done  >  <!--NeedCopy--> ```

To enable or disable MAC-based forwarding by using the GUI

In the navigation pane, expand System, and then click Settings.
In the details pane, under Modes and Features group, click Configure modes.
In the Configure Modes dialog box, to enable MAC-based forwarding mode, select the MAC Based Forwarding check box. To disable MAC-based forwarding mode, clear the check box.
Click OK. The Enable/Disable Mode(s)? message appears in the details pane.
Click Yes.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Packet forwarding modes

March 10, 2022

Contributed by:

C S

March 10, 2022

Contributed by:

C S

Packet forwarding modes

Enable and disable layer 2 mode

To enable or disable Layer 2 mode by using the CLI

Enable and disable layer 3 mode

Enable or disable Layer 3 mode by using the CLI

Enable or disable Layer 3 mode by using the GUI

Enable and disable MAC-based forwarding mode

Enable or disable MAC-based forwarding by using the CLI

In this article