Configure ICMP response suppression for virtual IP addresses
NetScaler provides granular control over Internet Control Message Protocol (ICMP) responses based on virtual server states. This enhancement allows administrators to configure how NetScaler responds to ICMP requests destined for Virtual IP addresses, considering the operational state of associated virtual servers. You can configure NetScaler to respond to pings only when your services are healthy.
This feature offers the following benefits:
-
Improved network monitoring and troubleshooting capabilities.
-
Enhanced control over Virtual IP visibility and response behavior.
-
Flexible configuration options to match different deployment scenarios.
Note:
Starting from NetScaler version 14.1-51.x, this feature extends support to IPv6 addresses in addition to the existing IPv4 support.
You can configure the ICMP responses in the following two ways:
-
IP address related configuration
-
Virtual server related configuration
IP related configuration
You can set rules that determine how your IP address handles ICMP requests. NetScaler uses these rules to determine whether to respond to incoming ICMP echo requests:
-
NONE: Responds always to ICMP requests (default behavior).
-
ONE_VSERVER: Responds if at least one virtual server on the IP is UP.
-
ALL_VSERVER: Responds only if all virtual servers on the IP are UP.
-
VSVR_CNTRLD: Uses per-virtual server settings to determine response behavior.
Configure IPv4 address with ICMP response control by using CLI
To add a new IPv4 address and configure ICMP response behavior, use the following command:
add ip <IPAddress> <Netmask> -type vip -icmpresponse <NONE|ONE_VSERVER| ALL_VSERVERS|VSVR_CNTRLD>
<!--NeedCopy-->
Examples:
add ns ip 3.4.5.6 255.255.255.255 -type VIP -icmpResponse NONE
add ns ip 3.4.5.7 255.255.255.255 -type VIP -icmpResponse ONE_VSERVER
add ns ip 3.4.5.8 255.255.255.255 -type VIP -icmpResponse ALL_VSERVERS
add ns ip 3.4.5.9 255.255.255.255 -type VIP -icmpResponse VSVR_CNTRLD
<!--NeedCopy-->
To modify the ICMP response behavior for an existing IPv4 address, use the following command:
set ip <IPAddress> -icmpresponse <NONE|ONE_VSERVER| ALL_VSERVERS|VSVR_CNTRLD>
<!--NeedCopy-->
Examples:
set ns ip 3.4.5.6 -icmpResponse ONE_VSERVER
set ns ip 3.4.5.7 -icmpResponse ALL_VSERVERS
set ns ip 3.4.5.8 -icmpResponse VSVR_CNTRLD
set ns ip 3.4.5.9 -icmpResponse NONE
<!--NeedCopy-->
To remove IPv4 address and reset the ICMP response setting to its default value, use the following command:
unset ip <IPAddress> -icmpresponse
<!--NeedCopy-->
Examples:
unset ns ip 3.4.5.6 -icmpresponse
unset ns ip 3.4.5.7 -icmpresponse
<!--NeedCopy-->
To view the current IPv4 address configuration and ICMP response settings, use the following command:
show ip <IPAddress>
<!--NeedCopy-->
Examples:
show ns ip 3.4.5.6
show ns ip 3.4.5.7
<!--NeedCopy-->
Configure IPv4 address with ICMP response control by using GUI
-
Navigate to System > Network > IPs.
-
From the list of IP addresses, select the IPv4 address you want to configure.
-
Click Edit to open the IP configuration dialog.
-
Click the ICMP Response tab.
-
From the ICMP Response drop-down menu, select one of the following options:
-
NONE - No ICMP response
-
ONE_VSERVER - Response from one virtual server
-
ALL_VSERVERS - Response from all virtual servers
-
VSVR_CNTRLD - Virtual server controlled response
-
-
Click OK to save the configuration.
Configure IPv6 address with ICMP response control
To add a new IPv6 address and configure ICMPv6 response behavior, use the following command:
add ip6 <IPv6Address>/<Prefix_length> -type vip -icmpresponse <NONE|ONE_VSERVER| ALL_VSERVERS|VSVR_CNTRLD>
<!--NeedCopy-->
Examples:
add ns ip6 3f86::50/128 -type VIP -icmpResponse NONE
add ns ip6 3f86::51/128 -type VIP -icmpResponse ONE_VSERVER
add ns ip6 3f86::52/128 -type VIP -icmpResponse ALL_VSERVERS
add ns ip6 3f86::53/128 -type VIP -icmpResponse VSVR_CNTRLD
<!--NeedCopy-->
To modify the ICMP response behavior for an existing IPv6 address, use the following command:
set ip6 <IPv6Address>/<Prefix_length> -icmpresponse <NONE|ONE_VSERVER| ALL_VSERVERS|VSVR_CNTRLD>
<!--NeedCopy-->
Examples:
set ns ip6 3f86::50/128 -icmpResponse ONE_VSERVER
set ns ip6 3f86::51/128 -icmpResponse ALL_VSERVERS
set ns ip6 3f86::52/128 -icmpResponse VSVR_CNTRLD
set ns ip6 3f86::53/128 -icmpResponse NONE
<!--NeedCopy-->
To remove IPv6 address and reset the ICMP response setting to its default value, use the following command:
unset ip6 <IPv6Address>/<Prefix_length> -icmpresponse
<!--NeedCopy-->
Examples:
unset ns ip6 3f86::50/128 -icmpresponse
unset ns ip6 3f86::51/128 -icmpresponse
<!--NeedCopy-->
To view the current IPv6 address configuration and ICMP response settings, use the following command:
show ip6 <IPv6Address>
<!--NeedCopy-->
Examples:
show ns ip6 3f86::50
show ns ip6 3f86::51
<!--NeedCopy-->
Note:
GUI support for configuring ICMP response settings is not available for IPv6 addresses. Use the CLI commands for IPv6 ICMP response configuration.
Virtual server related configuration
NetScaler evaluates each virtual server’s ICMP setting to decide whether that service affects ping responses. This feature supports the following virtual server types:
-
Load Balancing (LB)
-
Content Switching (CS)
-
Cache Redirection (CR)
-
Gateway/VPN virtual servers
The following configuration options are available:
-
PASSIVE: This virtual server doesn’t influence ping decisions - NetScaler responds normally (default)
-
ACTIVE: This virtual server controls ping responses - NetScaler responds only when the service is UP.
-
Mixed PASSIVE and ACTIVE: NetScaler responds if any ACTIVE virtual server is UP (PASSIVE virtual servers are ignored in the decision)
Configure ICMP response behavior for virtual server
To create a new virtual server and configure its ICMP response behavior, use the following command:
add lb/cs/cr/vpn vserver <name> <serviceType> <IPAddress> <port> -icmpVsrResponse <PASSIVE|ACTIVE>
<!--NeedCopy-->
Examples:
add lb vserver web_vs HTTP 10.10.10.100 80 -icmpVsrResponse ACTIVE
add cs vserver content_vs HTTP 10.10.10.101 80 -icmpVsrResponse PASSIVE
add cr vserver cache_vs HTTP 10.10.10.102 80 -icmpVsrResponse ACTIVE
add vpn vserver ssl_vs SSL 10.10.10.103 443 -icmpVsrResponse PASSIVE
<!--NeedCopy-->
To modify the ICMP response behavior for an existing virtual server, use the following command:
set lb/cs/cr/vpn vserver <name> -icmpVsrResponse <PASSIVE|ACTIVE>
<!--NeedCopy-->
Examples:
set lb vserver web_vs -icmpVsrResponse PASSIVE
set cs vserver content_vs -icmpVsrResponse ACTIVE
set cr vserver cache_vs -icmpVsrResponse PASSIVE
set vpn vserver ssl_vs -icmpVsrResponse ACTIVE
<!--NeedCopy-->
To remove the virtual server and reset the ICMP response behavior to its default value.
unset lb/cs/cr/vpn vserver <name> -icmpVsrResponse
<!--NeedCopy-->
Examples:
unset lb vserver web_vs -icmpVsrResponse
unset cs vserver content_vs -icmpVsrResponse
unset cr vserver cache_vs -icmpVsrResponse
unset vpn vserver ssl_vs -icmpVsrResponse
<!--NeedCopy-->