ADC

Blocking Traffic on Internal Ports

September 14, 2022

Contributed by:

By default, a Citrix ADC appliance does not block some type of internal traffic even using ACL rules.

The following table lists the internal traffic types that a Citrix ADC appliance does not block even using ACL rules:

Citrix ADC Setup	Protocol	Destination Port	Destination IP address
All	TCP	3008–3011	NSIP or SNIP
All	TCP	179	NSIP or SNIP
All	UDP	520	NSIP or SNIP
High availability	UDP	3003	NSIP
High availability	TCP	22	NSIP
Cluster	UDP	7000	NSIP

This feature of not blocking the earlier mentioned types of traffic is specified by the default setting of the global Layer-3 Implicit ACL Allow (implicitACLAllow) parameter.

You can disable this parameter if you want to block the earlier mentioned traffic types using the ACL rules. An appliance in a high availability setup makes an exception for its partner (primary or secondary) node. It does not block traffic from that node.

To disable or enable this parameter by using the CLI:

At the command prompt, type:

set l3param -implicitACLAllow [ENABLED DISABLED]
sh l3param

Note: The parameter implicitACLAllow is enabled by default.

Example:

> set l3param -implicitACLAllow DISABLED
Done
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Blocking Traffic on Internal Ports

September 14, 2022

Contributed by:

September 14, 2022

Contributed by:

Blocking Traffic on Internal Ports

In this article