ns acl6¶
The following operations can be performed on "ns acl6":
add | rm | set | unset | enable | disable | stat | rename | show
add ns acl6¶
Adds an ACL6 rule to the NetScaler appliance. To commit this operation, you must apply the ACL6s. ACL6 rules filter data packets on the basis of various parameters, such as IP address, source port, action, and protocol.
Synopsys¶
add ns acl6 <acl6name> <acl6action> [-td <positive_integer>] [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [-destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-TTL <positive_integer>] [-srcMac <mac_addr> [-srcMacMask <string>]] [(-protocol <protocol> [-established]) | -protocolNumber <positive_integer>] [-vlan <positive_integer> | -vxlan <positive_integer>] [-interface <interface_name>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )]
Arguments¶
acl6name
Name for the ACL6 rule. Must begin with an ASCII alphabetic or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters.
acl6action
Action to perform on the incoming IPv6 packets that match the ACL6 rule.
Available settings function as follows:
-
ALLOW - The NetScaler appliance processes the packet.
-
BRIDGE - The NetScaler appliance bridges the packet to the destination without processing it.
-
DENY - The NetScaler appliance drops the packet.
Possible values: BRIDGE, DENY, ALLOW
td
Integer value that uniquely identifies the traffic domain in which you want to configure the entity. If you do not specify an ID, the entity becomes part of the default traffic domain, which has an ID of 0.
Minimum value: 0
Maximum value: 4094
srcIPv6
IP address or range of IP addresses to match against the source IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator
Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcIPv6Val
Source IPv6 address (range).
srcPort
Port number or range of port numbers to match against the source port number of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen. For example: 40-90.
Note: The destination port can be specified only for TCP and UDP protocols.
srcPortVal
Source port (range).
Maximum value: 65535
destIPv6
IP address or range of IP addresses to match against the destination IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
destIPv6Val
Destination IPv6 address (range).
destPort
Port number or range of port numbers to match against the destination port number of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen. For example: 40-90.
Note: The destination port can be specified only for TCP and UDP protocols.
destPortVal
Destination port (range).
Maximum value: 65535
TTL
Time to expire this ACL6 (in seconds).
Minimum value: 1
Maximum value: 2147483647
srcMac
MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask
Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value "000000111111".
Default value: "000000000000"
protocol
Protocol, identified by protocol name, to match against the protocol of an incoming IPv6 packet.
Possible values: ICMPV6, TCP, UDP
protocolNumber
Protocol, identified by protocol number, to match against the protocol of an incoming IPv6 packet.
Minimum value: 1
Maximum value: 255
vlan
ID of the VLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs.
Minimum value: 1
Maximum value: 4094
vxlan
ID of the VXLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs.
Minimum value: 1
Maximum value: 16777215
interface
ID of an interface. The NetScaler appliance applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
established
Allow only incoming TCP packets that have the ACK or RST bit set if the action set for the ACL6 rule is ALLOW and these packets match the other conditions in the ACL6 rule.
icmpType
ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol.
Minimum value: 0
Maximum value: 65536
icmpCode
Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter.
Minimum value: 0
Maximum value: 65536
priority
Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created.
Minimum value: 1
Maximum value: 81920
state
State of the ACL6.
Possible values: ENABLED, DISABLED
Default value: ENABLED
Example¶
add ns acl6 rule1 DENY -srcport 45-1024 -destIPv6 2001::45 -protocol TCP
Related Commands¶
rm ns acl6¶
Removes an ACL6 rule from the NetScaler appliance. To commit this operation, you must apply the ACL6s.
Synopsys¶
rm ns acl6 <acl6name> ...
Arguments¶
acl6name
Name of the ACL6 rule that you want to remove.
Example¶
rm ns acl6 rule1
Related Commands¶
set ns acl6¶
Modifies the parameters of an ACL6 rule. To commit this operation, you must apply the ACL6s.
Synopsys¶
set ns acl6 <acl6name> [-aclaction <aclaction>] [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [-destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-srcMac <mac_addr> [-srcMacMask <string>]] [-protocol <protocol> | -protocolNumber <positive_integer>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-vlan <positive_integer> | -vxlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-established]
Arguments¶
acl6name
Name of the ACL6 rule whose parameters you want to modify.
aclaction
Action associated with the ACL6.
Possible values: BRIDGE, DENY, ALLOW
srcIPv6
IP address or range of IP addresses to match against the source IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
operator
Either the equals (=) or does not equal (!=) logical operator.
Possible values: =, !=, EQ, NEQ
srcIPv6Val
Source IPv6 address (range).
srcPort
Source Port (range).
srcPortVal
Source port (range).
Maximum value: 65535
destIPv6
IP address or range of IP addresses to match against the destination IP address of an incoming IPv6 packet. In the command line interface, separate the range with a hyphen.
destIPv6Val
Destination IPv6 address (range).
destPort
Destination Port (range).
destPortVal
Destination port (range).
Maximum value: 65535
srcMac
MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask
Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value "000000111111".
Default value: "000000000000"
protocol
Protocol, identified by protocol name, to match against the protocol of an incoming IPv6 packet.
Possible values: ICMPV6, TCP, UDP
protocolNumber
Protocol, identified by protocol number, to match against the protocol of an incoming IPv6 packet.
Minimum value: 1
Maximum value: 255
icmpType
ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol.
Minimum value: 0
Maximum value: 65536
icmpCode
Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter.
Minimum value: 0
Maximum value: 65536
vlan
ID of the VLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs.
Minimum value: 1
Maximum value: 4094
vxlan
ID of the VXLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs.
Minimum value: 1
Maximum value: 16777215
interface
ID of an interface. The NetScaler appliance applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
priority
Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created.
Minimum value: 1
Maximum value: 81920
established
Allow only incoming TCP packets that have the ACK or RST bit set if the action set for the ACL6 rule is ALLOW and these packets match the other conditions in the ACL6 rule.
Example¶
set ns acl6 rule1 -srcPort 50
Related Commands¶
unset ns acl6¶
Resets the attributes of the specified ACL6 rule. To commit this operation, you must apply the ACL6s.Attributes for which a default value is available revert to their default values. Refer to the set ns acl6 command for descriptions of the parameters..Refer to the set ns acl6 command for meanings of the arguments.
Synopsys¶
unset ns acl6 <acl6name> [-srcIPv6] [-srcPort] [-destIPv6] [-destPort] [-srcMac] [-srcMacMask] [-protocol] [-icmpType] [-icmpCode] [-vlan] [-vxlan] [-interface] [-established]
Example¶
unset ns acl6 rule1 -srcPort
Related Commands¶
enable ns acl6¶
Enables an ACL6 rule. To commit this operation, you must apply the ACL6s.After you apply the ACL6 rules, the NetScaler appliance compares incoming IPv6 packets to the enabled ACL6 rules.
Synopsys¶
enable ns acl6 <acl6name> ...
Arguments¶
acl6name
Name of ACL6 rule that you want to enable.
Example¶
enable ns acl6 rule1
Related Commands¶
disable ns acl6¶
Disables an ACL6 rule. To commit this operation, you must apply the ACL6s.After you apply the ACL6 rules, the NetScaler appliance does not compare incoming IPv6 packets to the disabled ACL6 rules.
Synopsys¶
disable ns acl6 <acl6name> ...
Arguments¶
acl6name
Name of ACL6 rule that you want to disable.
Example¶
disable ns acl6 rule1
Related Commands¶
stat ns acl6¶
Displays statistics related to the ACL6 rules. To display statistics of all the ACL6 rules, run the command without any parameters. To display statistics of a particular ACL6 rule, specify the name of the ACL6 rule.
Synopsys¶
stat ns acl6 [<acl6name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] [-clearstats ( basic | full )]
Arguments¶
acl6name
Name of the ACL6 rule whose statistics you want the NetScaler appliance to display.
detail
Specifies detailed output (including more statistics). The output can be quite voluminous. Without this argument, the output will show only a summary.
fullValues
Specifies that numbers and strings should be displayed in their full form. Without this option, long strings are shortened and large numbers are abbreviated
ntimes
The number of times, in intervals of seven seconds, the statistics should be displayed.
Default value: 1
Minimum value: 0
logFile
The name of the log file to be used as input.
clearstats
Clear the statsistics / counters
Possible values: basic, full
Outputs¶
count
devno
stateflag
Outputs¶
Bridge ACL6 hits (ACL6Bdg)
Packets matching a bridge IPv6 ACL, which is in transparent mode and bypasses service processing.
Deny ACL6 hits (ACL6Deny)
Packets dropped because they match IPv6 ACLs with processing mode set to DENY.
Allow ACL6 hits (ACL6Allow)
Packets matching IPv6 ACLs with processing mode set to ALLOW. NetScaler processes these packets.
NAT ACL6 hits (ACL6NAT)
Packets matching a NAT ACL6, resulting in a NAT session.
ACL6 hits (ACL6Hits)
Packets matching an IPv6 ACL.
ACL6 misses (ACL6Miss)
Packets not matching any IPv6 ACL.
NAT64 ACL6 hits (ACL6NAT64)
Packets matching a NAT64 ACL6, resulting in a NAT64 translation.
ACL6 Count (ACL6Count)
Total number of ACL6 rules configured.
Hits for this ACL6 (Hits)
Number of times the acl6 was hit
Example¶
stat acl6
Related Commands¶
- stat ns
- stat ns limitIdentifier
- stat ns acl
- stat ns simpleacl
- stat ns simpleacl6
- stat ns pbr
- stat ns memory
- stat ns pbr6
- stat ns trafficDomain
- stat ns partition
rename ns acl6¶
Renames an ACL6 rule. To commit this operation, you must apply the ACL6s.
Synopsys¶
rename ns acl6 <acl6name> <newName>
Arguments¶
acl6name
Name of the ACL6 rule that you want to rename.
newName
New name for the ACL6 rule. Must begin with an ASCII alphabetic or underscore \(_\) character, and must contain only ASCII alphanumeric, underscore, hash \(\#\), period \(.\), space, colon \(:\), at \(@\), equals \(=\), and hyphen \(-\) characters.
Example¶
rename acl6 rule rule-new
show ns acl6¶
Displays settings related to the ACL6 rules. To display settings of all the ACL6 rules, run the command without any parameters. To display settings of a particular ACL6 rule, specify the name of the ACL6 rule.
Synopsys¶
show ns acl6 [<acl6name>]
Arguments¶
acl6name
Name of the ACL6 rule whose details you want the NetScaler appliance to display.
Outputs¶
acl6action
Action to perform on the incoming IPv6 packets that match the ACL6 rule.
Available settings function as follows:
-
ALLOW - The NetScaler appliance processes the packet.
-
BRIDGE - The NetScaler appliance bridges the packet to the destination without processing it.
-
DENY - The NetScaler appliance drops the packet.
srcMac
MAC address to match against the source MAC address of an incoming IPv6 packet.
srcMacMask
Used to define range of Source MAC address. It takes string of 0 and 1, 0s are for exact match and 1s for wildcard. For matching first 3 bytes of MAC address, srcMacMask value "000000111111".
stateflag
ACL6 state flag.
protocol
Protocol number in IPv6 header or name.
protocolNumber
Protocol number in IPv6 header or name.
srcPortVal
Source port (range).
operator
Either the equals (=) or does not equal (!=) logical operator.
destPortVal
Destination port (range).
srcIPv6Val
Source IPv6 address (range).
destIPv6Val
Destination IPv6 address (range).
vlan
ID of the VLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VLAN. If you do not specify a VLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VLANs.
vxlan
ID of the VXLAN. The NetScaler appliance applies the ACL6 rule only to the incoming packets on the specified VXLAN. If you do not specify a VXLAN ID, the appliance applies the ACL6 rule to the incoming packets on all VXLANs.
state
State of the ACL6.
kernelstate
Commit status of the ACL6.
TTL
Time left to expire ACL6 (in seconds).
icmpType
ICMP Message type to match against the message type of an incoming IPv6 ICMP packet. For example, to block DESTINATION UNREACHABLE messages, you must specify 3 as the ICMP type.
Note: This parameter can be specified only for the ICMP protocol.
icmpCode
Code of a particular ICMP message type to match against the ICMP code of an incoming IPv6 ICMP packet. For example, to block DESTINATION HOST UNREACHABLE messages, specify 3 as the ICMP type and 1 as the ICMP code.
If you set this parameter, you must set the ICMP Type parameter.
interface
ID of an interface. The NetScaler appliance applies the ACL6 rule only to the incoming packets from the specified interface. If you do not specify any value, the appliance applies the ACL6 rule to the incoming packets from all interfaces.
hits
Number of hits of this ACL6.
established
This flag indicates that the ACL6 should be used for TCP response traffic only.
priority
Priority for the ACL6 rule, which determines the order in which it is evaluated relative to the other ACL6 rules. If you do not specify priorities while creating ACL6 rules, the ACL6 rules are evaluated in the order in which they are created.
time
Time when this acl is applied.
td
Integer value that uniquely identifies the traffic domain in which you want to configure the entity. If you do not specify an ID, the entity becomes part of the default traffic domain, which has an ID of 0.
aclassociate
ACL6 linked
devno
count
Example¶
show ns acl6 rule11) Name: r1 Action: DENY srcIPv6 = 2001::1 destIPv6 srcMac: srcMacMask: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 Hits: 0 TTL: