NS CommandReference Guide

Citrix NetScaler 10 Citrix NetScaler Command Reference Guide
2 | Citrix NetScaler 10 | Introduction
Notice
Copyright and Trademark Notice
CITRIX SYSTEMS, INC., 2012. ALL RIGHTS RESERVED. NO PART OF THIS DOCUMENT MAY BE REPRODUCED OR TRANSMITTED IN ANY FORM OR BY ANY MEANS OR USED TO MAKE DERIVATIVE WORK (SUCH AS TRANSLATION, TRANSFORMATION, OR ADAPTATION) WITHOUT THE EXPRESS WRITTEN PERMISSION OF CITRIX SYSTEMS, INC. ALTHOUGH THE MATERIAL PRESENTED IN THIS DOCUMENT IS BELIEVED TO BE ACCURATE, IT IS PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE ALL RESPONSIBILITY FOR THE USE OR APPLICATION OF THE PRODUCT(S) DESCRIBED IN THIS MANUAL. CITRIX SYSTEMS, INC. OR ITS SUPPLIERS DO NOT ASSUME ANY LIABILITY THAT MAY OCCUR DUE TO THE USE OR APPLICATION OF THE PRODUCT(S) DESCRIBED IN THIS DOCUMENT. INFORMATION IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. COMPANIES, NAMES, AND DATA USED IN EXAMPLES ARE FICTITIOUS UNLESS OTHERWISE NOTED. The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. Modifying the equipment without Citrix' written authorization may result in the equipment no longer complying with FCC requirements for Class A digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense. You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the NetScaler appliance. If the NetScaler equipment causes interference, try to correct the interference by using one or more of the following measures: Move the NetScaler equipment to one side or the other of your equipment. Move the NetScaler equipment farther away from your equipment. Plug the NetScaler equipment into an outlet on a different circuit from your equipment. (Make sure the NetScaler equipment and your equipment are on circuits controlled by different circuit breakers or fuses.) Modifications to this product not authorized by Citrix Systems, Inc., could void the FCC approval and negate your authority to operate the product.
4 | Citrix NetScaler 10 | Copyright and Trademark Notice
BroadCom is a registered trademark of BroadCom Corporation. Fast Ramp, NetScaler, and NetScaler Request Switch are trademarks of Citrix Systems, Inc. Linux is a registered trademark of Linus Torvalds. Internet Explorer, Microsoft, PowerPoint, Windows and Windows product names such as Windows NT are trademarks or registered trademarks of the Microsoft Corporation. NetScape is a registered trademark of Netscape Communications Corporation. Red Hat is a trademark of Red Hat, Inc. Sun and Sun Microsystems are registered trademarks of Sun Microsystems, Inc. Other brand and product names may be registered trademarks or trademarks of their respective holders. Portions of this software may be redistributed under an open source license. Information about those portions of the software, including a listing of all third party attribution notices and open source license agreements can be found at http://www.citrix.com/lang/English/lp/lp_2305124.asp. All rights reserved. Last Updated: June 2012 Document code: June 19 2012 01:15:06
Citrix NetScaler 10 | TOC | 5
Contents
About the NetScaler Documentation LibraryPreface..................................................... 35
Chapter 1: Introduction - Classic CLI.........................................................39

How to use This Reference.................................................................................................................... 40 Command Conventions.......................................................................................................................... 40 Command Line Overview...................................................................................................................... 41 Basic Command Line Usage...................................................................................................... 41 Advanced Command Line Usage...............................................................................................45
Chapter 2: Introduction - Contextual CLI..................................................49

How to use This Reference.................................................................................................................... 50 Command Conventions.......................................................................................................................... 50 Command Line Overview...................................................................................................................... 51 Basic Command Line Usage...................................................................................................... 51 Advanced Command Line Usage...............................................................................................56
Chapter 3: AAA Commands.........................................................................61

stat aaa.................................................................................................................................................... 63 add aaa user............................................................................................................................................ 63 rm aaa user............................................................................................................................................. 64 set aaa user............................................................................................................................................. 64 bind aaa user...........................................................................................................................................65 unbind aaa user.......................................................................................................................................65 show aaa user......................................................................................................................................... 66 add aaa group......................................................................................................................................... 67 rm aaa group...........................................................................................................................................68 bind aaa group........................................................................................................................................ 68 unbind aaa group.................................................................................................................................... 69 show aaa group.......................................................................................................................................70 add aaa preauthenticationaction............................................................................................................. 71 rm aaa preauthenticationaction...............................................................................................................71 set aaa preauthenticationaction...............................................................................................................72 unset aaa preauthenticationaction...........................................................................................................72 show aaa preauthenticationaction...........................................................................................................73 add aaa preauthenticationpolicy............................................................................................................. 74 rm aaa preauthenticationpolicy.............................................................................................................. 74 set aaa preauthenticationpolicy.............................................................................................................. 74 show aaa preauthenticationpolicy.......................................................................................................... 75 show aaa stats......................................................................................................................................... 76 show aaa session.....................................................................................................................................76 kill aaa session........................................................................................................................................77 set aaa radiusParams...............................................................................................................................78 unset aaa radiusParams...........................................................................................................................79 show aaa radiusParams...........................................................................................................................80 set aaa ldapParams................................................................................................................................. 81 unset aaa ldapParams............................................................................................................................. 82 show aaa ldapParams............................................................................................................................. 83 set aaa tacacsParams...............................................................................................................................84
6 | Citrix NetScaler 10 | TOC
unset aaa tacacsParams...........................................................................................................................85 show aaa tacacsParams...........................................................................................................................85 set aaa certParams.................................................................................................................................. 86 unset aaa certParams.............................................................................................................................. 87 show aaa certParams.............................................................................................................................. 87 set aaa parameter.................................................................................................................................... 88 unset aaa parameter................................................................................................................................ 88 show aaa parameter................................................................................................................................ 89 set aaa preauthenticationparameter........................................................................................................ 89 unset aaa preauthenticationparameter.................................................................................................... 90 show aaa preauthenticationparameter.................................................................................................... 90 bind aaa global....................................................................................................................................... 91 unbind aaa global................................................................................................................................... 91 show aaa global...................................................................................................................................... 92
Chapter 4: APP Commands.........................................................................93

import application.................................................................................................................................. 94 export application................................................................................................................................... 94
Chapter 5: AppFlow Commands.................................................................95

stat appflow............................................................................................................................................ 96 add appflow collector............................................................................................................................. 96 rm appflow collector.............................................................................................................................. 97 rename appflow collector....................................................................................................................... 97 show appflow collector.......................................................................................................................... 98 add appflow action................................................................................................................................. 98 rm appflow action...................................................................................................................................99 set appflow action.................................................................................................................................100 unset appflow action.............................................................................................................................100 rename appflow action......................................................................................................................... 101 show appflow action.............................................................................................................................101 add appflow policy............................................................................................................................... 102 rm appflow policy................................................................................................................................ 103 set appflow policy................................................................................................................................ 103 unset appflow policy............................................................................................................................ 104 rename appflow policy......................................................................................................................... 104 show appflow policy............................................................................................................................ 105 add appflow policylabel....................................................................................................................... 106 rm appflow policylabel.........................................................................................................................107 bind appflow policylabel...................................................................................................................... 107 unbind appflow policylabel.................................................................................................................. 108 rename appflow policylabel................................................................................................................. 108 show appflow policylabel.....................................................................................................................109 set appflow param................................................................................................................................ 110 unset appflow param............................................................................................................................ 112 show appflow param............................................................................................................................ 112 bind appflow global..............................................................................................................................113 unbind appflow global..........................................................................................................................114 show appflow global............................................................................................................................ 114
Chapter 6: Application Firewall Commands........................................... 117

stat appfw............................................................................................................................................. 119 add appfw fieldType.............................................................................................................................121
rm appfw fieldType.............................................................................................................................. 121 set appfw fieldType.............................................................................................................................. 122 show appfw fieldType.......................................................................................................................... 122 add appfw profile................................................................................................................................. 123 rm appfw profile...................................................................................................................................129 set appfw profile...................................................................................................................................129 unset appfw profile...............................................................................................................................134 bind appfw profile................................................................................................................................ 135 unbind appfw profile............................................................................................................................ 137 show appfw profile...............................................................................................................................138 stat appfw profile..................................................................................................................................147 archive appfw profile........................................................................................................................... 149 restore appfw profile............................................................................................................................ 150 add appfw policy.................................................................................................................................. 151 rm appfw policy................................................................................................................................... 151 set appfw policy................................................................................................................................... 152 unset appfw policy............................................................................................................................... 152 show appfw policy............................................................................................................................... 153 stat appfw policy.................................................................................................................................. 154 rename appfw policy............................................................................................................................ 155 add appfw policylabel.......................................................................................................................... 156 rm appfw policylabel............................................................................................................................156 bind appfw policylabel......................................................................................................................... 157 unbind appfw policylabel..................................................................................................................... 157 show appfw policylabel........................................................................................................................158 stat appfw policylabel...........................................................................................................................159 rename appfw policylabel.................................................................................................................... 160 add appfw confidField..........................................................................................................................161 rm appfw confidField........................................................................................................................... 161 set appfw confidField........................................................................................................................... 162 unset appfw confidField....................................................................................................................... 162 show appfw confidField....................................................................................................................... 163 show appfw stats.................................................................................................................................. 164 rm appfw customSettings..................................................................................................................... 164 show appfw customSettings................................................................................................................. 164 import appfw customSettings...............................................................................................................165 update appfw customSettings...............................................................................................................165 rm appfw xmlerrorpage........................................................................................................................ 166 show appfw xmlerrorpage.................................................................................................................... 166 import appfw xmlerrorpage..................................................................................................................167 update appfw xmlerrorpage..................................................................................................................167 rm appfw htmlerrorpage.......................................................................................................................168 show appfw htmlerrorpage...................................................................................................................168 import appfw htmlerrorpage.................................................................................................................169 update appfw htmlerrorpage.................................................................................................................169 set appfw settings................................................................................................................................. 170 unset appfw settings............................................................................................................................. 171 show appfw settings............................................................................................................................. 172 bind appfw global.................................................................................................................................173 unbind appfw global.............................................................................................................................173 show appfw global............................................................................................................................... 173 set appfw learningsettings.................................................................................................................... 175 unset appfw learningsettings................................................................................................................ 176 show appfw learningsettings................................................................................................................ 177 rm appfw learningdata..........................................................................................................................178 show appfw learningdata......................................................................................................................179
reset appfw learningdata.......................................................................................................................180 export appfw learningdata.................................................................................................................... 180 rm appfw wsdl...................................................................................................................................... 181 show appfw wsdl.................................................................................................................................. 181 import appfw wsdl................................................................................................................................182 rm appfw signatures............................................................................................................................. 182 show appfw signatures......................................................................................................................... 183 import appfw signatures....................................................................................................................... 183 update appfw signatures....................................................................................................................... 184 rm appfw xmlschema........................................................................................................................... 184 show appfw xmlschema....................................................................................................................... 185 import appfw xmlschema..................................................................................................................... 185 add appfw XMLContentType.............................................................................................................. 186 rm appfw XMLContentType................................................................................................................186 show appfw XMLContentType............................................................................................................187 show appfw archive..............................................................................................................................187 export appfw archive............................................................................................................................ 188 import appfw archive........................................................................................................................... 188 rm appfw archive..................................................................................................................................189
Chapter 7: Auditing Commands............................................................... 191

stat audit............................................................................................................................................... 192 add audit syslogAction......................................................................................................................... 193 rm audit syslogAction.......................................................................................................................... 194 set audit syslogAction.......................................................................................................................... 194 unset audit syslogAction...................................................................................................................... 195 show audit syslogAction...................................................................................................................... 196 add audit syslogPolicy..........................................................................................................................197 rm audit syslogPolicy........................................................................................................................... 197 set audit syslogPolicy........................................................................................................................... 198 unset audit syslogPolicy....................................................................................................................... 198 show audit syslogPolicy....................................................................................................................... 199 add audit nslogAction...........................................................................................................................200 rm audit nslogAction............................................................................................................................ 201 set audit nslogAction............................................................................................................................ 201 unset audit nslogAction........................................................................................................................ 202 show audit nslogAction........................................................................................................................ 203 add audit nslogPolicy........................................................................................................................... 204 rm audit nslogPolicy.............................................................................................................................204 set audit nslogPolicy.............................................................................................................................205 unset audit nslogPolicy.........................................................................................................................205 show audit nslogPolicy.........................................................................................................................206 add audit messageaction.......................................................................................................................207 rm audit messageaction........................................................................................................................ 207 set audit messageaction........................................................................................................................ 208 unset audit messageaction.................................................................................................................... 208 show audit messageaction.................................................................................................................... 209 show audit stats.................................................................................................................................... 210 show audit messages............................................................................................................................ 210 set audit syslogParams......................................................................................................................... 211 unset audit syslogParams..................................................................................................................... 212 show audit syslogParams..................................................................................................................... 212 set audit nslogParams........................................................................................................................... 213 unset audit nslogParams....................................................................................................................... 214 show audit nslogParams....................................................................................................................... 214
Chapter 8: Authentication Commands......................................................217

add authentication samlAction............................................................................................................. 219 add authentication radiusAction...........................................................................................................219 rm authentication radiusAction............................................................................................................ 221 set authentication radiusAction............................................................................................................ 221 unset authentication radiusAction........................................................................................................ 223 show authentication radiusAction........................................................................................................ 223 add authentication ldapAction..............................................................................................................224 rm authentication ldapAction............................................................................................................... 226 set authentication ldapAction............................................................................................................... 227 unset authentication ldapAction........................................................................................................... 228 show authentication ldapAction........................................................................................................... 229 add authentication tacacsAction...........................................................................................................230 rm authentication tacacsAction............................................................................................................ 231 set authentication tacacsAction............................................................................................................ 231 unset authentication tacacsAction........................................................................................................ 232 show authentication tacacsAction........................................................................................................ 233 add authentication nt4Action............................................................................................................... 233 rm authentication nt4Action.................................................................................................................234 set authentication nt4Action.................................................................................................................235 unset authentication nt4Action.............................................................................................................235 show authentication nt4Action.............................................................................................................236 add authentication certAction...............................................................................................................237 rm authentication certAction................................................................................................................ 237 set authentication certAction................................................................................................................ 238 unset authentication certAction............................................................................................................ 238 show authentication certAction............................................................................................................ 239 add authentication localPolicy............................................................................................................. 240 rm authentication localPolicy...............................................................................................................240 set authentication localPolicy...............................................................................................................241 unset authentication localPolicy...........................................................................................................241 show authentication localPolicy...........................................................................................................241 add authentication radiusPolicy........................................................................................................... 242 rm authentication radiusPolicy.............................................................................................................243 set authentication radiusPolicy.............................................................................................................243 unset authentication radiusPolicy.........................................................................................................244 show authentication radiusPolicy.........................................................................................................244 add authentication certPolicy............................................................................................................... 245 rm authentication certPolicy.................................................................................................................246 set authentication certPolicy.................................................................................................................246 unset authentication certPolicy.............................................................................................................247 show authentication certPolicy.............................................................................................................247 add authentication ldapPolicy.............................................................................................................. 248 rm authentication ldapPolicy................................................................................................................248 set authentication ldapPolicy................................................................................................................249 unset authentication ldapPolicy............................................................................................................249 show authentication ldapPolicy............................................................................................................250 add authentication tacacsPolicy........................................................................................................... 250 rm authentication tacacsPolicy.............................................................................................................251 set authentication tacacsPolicy.............................................................................................................251 unset authentication tacacsPolicy.........................................................................................................252 show authentication tacacsPolicy.........................................................................................................252 add authentication nt4Policy................................................................................................................ 253 rm authentication nt4Policy................................................................................................................. 254
set authentication nt4Policy................................................................................................................. 254 unset authentication nt4Policy............................................................................................................. 255 show authentication nt4Policy............................................................................................................. 255 add authentication vserver....................................................................................................................256 rm authentication vserver..................................................................................................................... 257 set authentication vserver..................................................................................................................... 257 unset authentication vserver................................................................................................................. 258 bind authentication vserver.................................................................................................................. 259 unbind authentication vserver.............................................................................................................. 259 enable authentication vserver............................................................................................................... 259 disable authentication vserver.............................................................................................................. 260 show authentication vserver................................................................................................................. 260 stat authentication vserver.................................................................................................................... 263
Chapter 9: Authorization Commands...................................................... 265

add authorization policy....................................................................................................................... 266 rm authorization policy........................................................................................................................ 266 set authorization policy........................................................................................................................ 267 unset authorization policy.................................................................................................................... 267 show authorization policy.................................................................................................................... 268 add authorization policylabel............................................................................................................... 269 rm authorization policylabel.................................................................................................................269 bind authorization policylabel.............................................................................................................. 270 unbind authorization policylabel.......................................................................................................... 270 show authorization policylabel.............................................................................................................271 stat authorization policylabel............................................................................................................... 272
Chapter 10: Base Commands.................................................................... 275

add location.......................................................................................................................................... 277 rm location............................................................................................................................................277 show location........................................................................................................................................278 add locationFile.................................................................................................................................... 279 rm locationFile..................................................................................................................................... 279 show locationFile................................................................................................................................. 280 add server............................................................................................................................................. 280 rm server...............................................................................................................................................281 set server...............................................................................................................................................282 unset server...........................................................................................................................................282 enable server.........................................................................................................................................283 disable server........................................................................................................................................284 show server...........................................................................................................................................284 rename server....................................................................................................................................... 286 add service............................................................................................................................................286 rm service............................................................................................................................................. 290 set service............................................................................................................................................. 290 unset service......................................................................................................................................... 293 bind service.......................................................................................................................................... 293 unbind service...................................................................................................................................... 294 enable service....................................................................................................................................... 295 disable service...................................................................................................................................... 295 show service......................................................................................................................................... 296 rename service......................................................................................................................................300 stat service............................................................................................................................................ 301 add serviceGroup..................................................................................................................................303
rm serviceGroup................................................................................................................................... 306 set serviceGroup................................................................................................................................... 306 unset serviceGroup............................................................................................................................... 309 bind serviceGroup................................................................................................................................ 309 unbind serviceGroup............................................................................................................................ 310 enable serviceGroup............................................................................................................................. 311 disable serviceGroup............................................................................................................................ 312 show serviceGroup............................................................................................................................... 313 stat serviceGroup..................................................................................................................................317 rename serviceGroup............................................................................................................................317 restart dbsMonitors...............................................................................................................................318 clear locationData.................................................................................................................................318 show servicegroupbindings.................................................................................................................. 319 stat serviceGroupMember.................................................................................................................... 319 show configstatus................................................................................................................................. 321 set locationParameter........................................................................................................................... 321 unset locationParameter....................................................................................................................... 322 show locationParameter....................................................................................................................... 322 rm vserver.............................................................................................................................................324 set vserver.............................................................................................................................................324 unset vserver.........................................................................................................................................325 enable vserver.......................................................................................................................................326 disable vserver......................................................................................................................................326 show vserver.........................................................................................................................................327 set uiinternal......................................................................................................................................... 330 unset uiinternal..................................................................................................................................... 331 show uiinternal..................................................................................................................................... 331 enable reporting....................................................................................................................................332 disable reporting................................................................................................................................... 332 show reporting......................................................................................................................................333 start nstrace...........................................................................................................................................333 stop nstrace........................................................................................................................................... 335 show nstrace......................................................................................................................................... 335
Chapter 11: Integrated Caching Commands........................................... 339

stat cache.............................................................................................................................................. 341 add cache policy................................................................................................................................... 344 rm cache policy.................................................................................................................................... 345 set cache policy.................................................................................................................................... 346 unset cache policy................................................................................................................................ 347 show cache policy................................................................................................................................ 347 stat cache policy................................................................................................................................... 349 rename cache policy............................................................................................................................. 349 add cache policylabel........................................................................................................................... 350 rm cache policylabel.............................................................................................................................350 bind cache policylabel.......................................................................................................................... 351 unbind cache policylabel...................................................................................................................... 351 show cache policylabel.........................................................................................................................352 stat cache policylabel........................................................................................................................... 353 rename cache policylabel..................................................................................................................... 354 add cache contentGroup....................................................................................................................... 354 rm cache contentGroup........................................................................................................................ 357 set cache contentGroup........................................................................................................................ 358 unset cache contentGroup.................................................................................................................... 360 show cache contentGroup.................................................................................................................... 361
expire cache contentGroup...................................................................................................................364 flush cache contentGroup.....................................................................................................................365 add cache forwardProxy.......................................................................................................................365 rm cache forwardProxy........................................................................................................................ 366 show cache forwardProxy.................................................................................................................... 366 add cache selector.................................................................................................................................367 rm cache selector.................................................................................................................................. 367 set cache selector.................................................................................................................................. 367 show cache selector.............................................................................................................................. 368 show cache object.................................................................................................................................369 expire cache object............................................................................................................................... 372 flush cache object................................................................................................................................. 373 show cache stats................................................................................................................................... 374 bind cache global..................................................................................................................................374 unbind cache global..............................................................................................................................374 show cache global................................................................................................................................ 375 set cache parameter.............................................................................................................................. 376 unset cache parameter.......................................................................................................................... 377 show cache parameter.......................................................................................................................... 378
Chapter 12: CLI Commands..................................................................... 381

config....................................................................................................................................................382 whoami................................................................................................................................................. 382 exit........................................................................................................................................................ 382 quit........................................................................................................................................................382 man....................................................................................................................................................... 383 history...................................................................................................................................................383 help....................................................................................................................................................... 383 source................................................................................................................................................... 384 batch..................................................................................................................................................... 385 unalias...................................................................................................................................................385 alias.......................................................................................................................................................386 cls......................................................................................................................................................... 386 show cli attribute.................................................................................................................................. 386 clear cli prompt.....................................................................................................................................387 set cli prompt........................................................................................................................................ 387 show cli prompt.................................................................................................................................... 388 set cli mode...........................................................................................................................................388 unset cli mode.......................................................................................................................................389 show cli mode.......................................................................................................................................389
Chapter 13: Cluster Commands................................................................391

join cluster............................................................................................................................................ 392 add cluster instance.............................................................................................................................. 392 rm cluster instance................................................................................................................................393 set cluster instance................................................................................................................................393 unset cluster instance............................................................................................................................394 enable cluster instance..........................................................................................................................394 disable cluster instance.........................................................................................................................395 show cluster instance............................................................................................................................395 add cluster node....................................................................................................................................397 set cluster node..................................................................................................................................... 398 unset cluster node................................................................................................................................. 398 rm cluster node..................................................................................................................................... 399
show cluster node................................................................................................................................. 399 sync cluster files................................................................................................................................... 400
Chapter 14: Compression Commands...................................................... 403

stat cmp................................................................................................................................................ 404 add cmp action..................................................................................................................................... 406 rm cmp action.......................................................................................................................................407 show cmp action...................................................................................................................................407 rename cmp action............................................................................................................................... 408 add cmp policy..................................................................................................................................... 409 rm cmp policy.......................................................................................................................................410 set cmp policy.......................................................................................................................................410 unset cmp policy...................................................................................................................................411 show cmp policy...................................................................................................................................411 stat cmp policy..................................................................................................................................... 414 rename cmp policy............................................................................................................................... 414 add cmp policylabel............................................................................................................................. 415 rm cmp policylabel...............................................................................................................................415 bind cmp policylabel............................................................................................................................ 416 unbind cmp policylabel........................................................................................................................ 417 show cmp policylabel...........................................................................................................................417 stat cmp policylabel..............................................................................................................................418 rename cmp policylabel....................................................................................................................... 419 show cmp stats..................................................................................................................................... 420 bind cmp global.................................................................................................................................... 420 unbind cmp global................................................................................................................................ 421 show cmp global...................................................................................................................................421 set cmp parameter.................................................................................................................................422 unset cmp parameter.............................................................................................................................423 show cmp parameter.............................................................................................................................424
Chapter 15: Cache Redirection Commands.............................................427

add cr policy......................................................................................................................................... 428 rm cr policy.......................................................................................................................................... 428 set cr policy.......................................................................................................................................... 429 show cr policy...................................................................................................................................... 430 add cr vserver....................................................................................................................................... 431 rm cr vserver.........................................................................................................................................434 set cr vserver.........................................................................................................................................435 unset cr vserver.....................................................................................................................................437 bind cr vserver...................................................................................................................................... 438 unbind cr vserver.................................................................................................................................. 438 enable cr vserver...................................................................................................................................439 disable cr vserver..................................................................................................................................439 show cr vserver.....................................................................................................................................440 stat cr vserver....................................................................................................................................... 444 rename cr vserver................................................................................................................................. 445
Chapter 16: Content Switching Commands.............................................447

add cs policy.........................................................................................................................................448 rm cs policy.......................................................................................................................................... 449 set cs policy.......................................................................................................................................... 449 unset cs policy...................................................................................................................................... 450
show cs policy...................................................................................................................................... 450 add cs policylabel................................................................................................................................. 451 rm cs policylabel.................................................................................................................................. 452 bind cs policylabel................................................................................................................................452 unbind cs policylabel............................................................................................................................453 show cs policylabel.............................................................................................................................. 453 add cs vserver....................................................................................................................................... 454 rm cs vserver........................................................................................................................................ 458 set cs vserver........................................................................................................................................ 459 unset cs vserver.................................................................................................................................... 462 bind cs vserver......................................................................................................................................463 unbind cs vserver..................................................................................................................................464 enable cs vserver.................................................................................................................................. 464 disable cs vserver................................................................................................................................. 465 show cs vserver.................................................................................................................................... 465 stat cs vserver....................................................................................................................................... 470 rename cs vserver................................................................................................................................. 471
Chapter 17: DNS Commands.................................................................... 473

stat dns..................................................................................................................................................475 add dns aaaaRec................................................................................................................................... 478 rm dns aaaaRec.....................................................................................................................................479 show dns aaaaRec.................................................................................................................................479 add dns addRec.....................................................................................................................................480 rm dns addRec...................................................................................................................................... 480 show dns addRec.................................................................................................................................. 481 add dns txtRec...................................................................................................................................... 482 rm dns txtRec....................................................................................................................................... 482 show dns txtRec................................................................................................................................... 483 add dns cnameRec................................................................................................................................ 484 rm dns cnameRec................................................................................................................................. 484 show dns cnameRec............................................................................................................................. 485 add dns mxRec..................................................................................................................................... 485 rm dns mxRec.......................................................................................................................................486 set dns mxRec.......................................................................................................................................487 unset dns mxRec...................................................................................................................................487 show dns mxRec...................................................................................................................................488 add dns nsRec.......................................................................................................................................489 rm dns nsRec........................................................................................................................................ 489 show dns nsRec.................................................................................................................................... 489 add dns ptrRec...................................................................................................................................... 490 rm dns ptrRec....................................................................................................................................... 491 show dns ptrRec................................................................................................................................... 491 add dns srvRec..................................................................................................................................... 492 rm dns srvRec.......................................................................................................................................493 set dns srvRec.......................................................................................................................................493 unset dns srvRec...................................................................................................................................494 show dns srvRec...................................................................................................................................494 add dns soaRec..................................................................................................................................... 495 rm dns soaRec...................................................................................................................................... 496 set dns soaRec...................................................................................................................................... 497 unset dns soaRec.................................................................................................................................. 498 show dns soaRec.................................................................................................................................. 498 add dns suffix....................................................................................................................................... 500 rm dns suffix.........................................................................................................................................500
show dns suffix.....................................................................................................................................500 add dns nameServer............................................................................................................................. 501 rm dns nameServer...............................................................................................................................502 enable dns nameServer.........................................................................................................................502 disable dns nameServer........................................................................................................................ 503 show dns nameServer...........................................................................................................................503 add dns view.........................................................................................................................................504 rm dns view.......................................................................................................................................... 505 show dns view...................................................................................................................................... 505 add dns policy.......................................................................................................................................506 rm dns policy........................................................................................................................................ 507 set dns policy........................................................................................................................................ 507 show dns policy.................................................................................................................................... 508 add dns zone......................................................................................................................................... 509 set dns zone.......................................................................................................................................... 510 unset dns zone...................................................................................................................................... 510 rm dns zone.......................................................................................................................................... 511 sign dns zone........................................................................................................................................ 511 unsign dns zone.................................................................................................................................... 512 show dns zone...................................................................................................................................... 512 add dns key...........................................................................................................................................513 create dns key....................................................................................................................................... 514 set dns key............................................................................................................................................ 515 unset dns key........................................................................................................................................ 516 rm dns key............................................................................................................................................ 516 show dns key........................................................................................................................................ 517 flush dns proxyRecords........................................................................................................................ 518 stat dns records..................................................................................................................................... 518 show dns stats.......................................................................................................................................519 set dns parameter.................................................................................................................................. 519 unset dns parameter.............................................................................................................................. 520 show dns parameter.............................................................................................................................. 521 add dns policylabel...............................................................................................................................522 rm dns policylabel................................................................................................................................ 522 bind dns policylabel............................................................................................................................. 523 unbind dns policylabel......................................................................................................................... 523 show dns policylabel............................................................................................................................ 524 stat dns policylabel............................................................................................................................... 525 rename dns policylabel.........................................................................................................................526 bind dns global..................................................................................................................................... 526 unbind dns global................................................................................................................................. 527 show dns global.................................................................................................................................... 527 add dns action.......................................................................................................................................528 rm dns action........................................................................................................................................ 529 set dns action........................................................................................................................................ 530 unset dns action.................................................................................................................................... 530 show dns action.................................................................................................................................... 531 show dns nsecRec.................................................................................................................................532
Chapter 18: DataStream commands.........................................................533

add db user........................................................................................................................................... 534 rm db user.............................................................................................................................................534 set db user.............................................................................................................................................534 show db user.........................................................................................................................................535
Chapter 19: DoS Commands..................................................................... 537

stat dos..................................................................................................................................................538 add dos policy.......................................................................................................................................538 rm dos policy........................................................................................................................................ 539 set dos policy........................................................................................................................................ 539 unset dos policy.................................................................................................................................... 540 show dos policy.................................................................................................................................... 540 stat dos policy.......................................................................................................................................541 show dos stats.......................................................................................................................................542
Chapter 20: Filter Commands...................................................................545

add filter action.....................................................................................................................................546 rm filter action...................................................................................................................................... 546 set filter action...................................................................................................................................... 547 unset filter action.................................................................................................................................. 548 show filter action.................................................................................................................................. 548 add filter htmlinjectionvariable............................................................................................................ 549 rm filter htmlinjectionvariable............................................................................................................. 550 set filter htmlinjectionvariable............................................................................................................. 550 unset filter htmlinjectionvariable......................................................................................................... 551 show filter htmlinjectionvariable......................................................................................................... 551 add filter policy.................................................................................................................................... 552 rm filter policy......................................................................................................................................553 set filter policy......................................................................................................................................554 unset filter policy..................................................................................................................................554 show filter policy..................................................................................................................................555 set filter prebodyInjection.................................................................................................................... 556 unset filter prebodyInjection................................................................................................................ 556 show filter prebodyInjection................................................................................................................ 557 set filter postbodyInjection...................................................................................................................557 unset filter postbodyInjection...............................................................................................................558 show filter postbodyInjection...............................................................................................................558 set filter htmlinjectionparameter.......................................................................................................... 558 unset filter htmlinjectionparameter...................................................................................................... 559 show filter htmlinjectionparameter...................................................................................................... 559 bind filter global................................................................................................................................... 560 unbind filter global............................................................................................................................... 561 show filter global..................................................................................................................................561
Chapter 21: Gslb Commands.................................................................... 563

add gslb site.......................................................................................................................................... 565 rm gslb site........................................................................................................................................... 566 set gslb site........................................................................................................................................... 566 unset gslb site....................................................................................................................................... 567 show gslb site....................................................................................................................................... 567 stat gslb site.......................................................................................................................................... 569 add gslb service.................................................................................................................................... 571 rm gslb service..................................................................................................................................... 573 set gslb service..................................................................................................................................... 573 unset gslb service................................................................................................................................. 575 bind gslb service...................................................................................................................................575 unbind gslb service...............................................................................................................................576
show gslb service................................................................................................................................. 577 stat gslb service.................................................................................................................................... 579 rename gslb service.............................................................................................................................. 581 add gslb vserver....................................................................................................................................581 rm gslb vserver..................................................................................................................................... 584 set gslb vserver..................................................................................................................................... 585 unset gslb vserver................................................................................................................................. 587 bind gslb vserver.................................................................................................................................. 588 unbind gslb vserver.............................................................................................................................. 589 enable gslb vserver............................................................................................................................... 589 disable gslb vserver.............................................................................................................................. 590 show gslb vserver................................................................................................................................. 591 stat gslb vserver.................................................................................................................................... 594 rename gslb vserver..............................................................................................................................596 add gslb policy..................................................................................................................................... 596 rm gslb policy.......................................................................................................................................597 set gslb policy.......................................................................................................................................597 show gslb policy...................................................................................................................................598 add gslb action......................................................................................................................................599 rm gslb action....................................................................................................................................... 599 set gslb action....................................................................................................................................... 600 show gslb action................................................................................................................................... 600 show gslb runningConfig..................................................................................................................... 601 stat gslb domain....................................................................................................................................601 clear gslb ldnsentries............................................................................................................................ 602 show gslb ldnsentries........................................................................................................................... 602 set gslb parameter.................................................................................................................................603 unset gslb parameter.............................................................................................................................604 show gslb parameter.............................................................................................................................604 rm gslb ldnsentry.................................................................................................................................. 605 sync gslb config....................................................................................................................................605 show gslb syncStatus............................................................................................................................606
Chapter 22: Ha Commands....................................................................... 607

add HA node.........................................................................................................................................608 rm HA node.......................................................................................................................................... 608 set HA node.......................................................................................................................................... 609 unset HA node...................................................................................................................................... 610 bind HA node....................................................................................................................................... 610 unbind HA node................................................................................................................................... 611 show HA node...................................................................................................................................... 611 stat HA node.........................................................................................................................................613 force HA sync.......................................................................................................................................614 sync HA files........................................................................................................................................ 615 force HA failover................................................................................................................................. 615
Chapter 23: Ha Commands....................................................................... 617

add HA node.........................................................................................................................................618 rm HA node.......................................................................................................................................... 618 set HA node.......................................................................................................................................... 619 unset HA node...................................................................................................................................... 620 bind HA node....................................................................................................................................... 620 unbind HA node................................................................................................................................... 621 show HA node...................................................................................................................................... 621
stat HA node.........................................................................................................................................623 force HA sync.......................................................................................................................................624 sync HA files........................................................................................................................................ 625 force HA failover................................................................................................................................. 625
Chapter 24: Ipsec Commands....................................................................627

add ipsec peer....................................................................................................................................... 628 show ipsec peer.................................................................................................................................... 628 rm ipsec peer........................................................................................................................................ 630 set ipsec parameter............................................................................................................................... 630 unset ipsec parameter........................................................................................................................... 631 show ipsec parameter........................................................................................................................... 631 stat ipsec counters.................................................................................................................................632
Chapter 25: Lb Commands........................................................................633

add lb monitor...................................................................................................................................... 635 rm lb monitor........................................................................................................................................639 set lb monitor........................................................................................................................................640 unset lb monitor....................................................................................................................................644 enable lb monitor..................................................................................................................................645 disable lb monitor.................................................................................................................................646 bind lb monitor..................................................................................................................................... 646 unbind lb monitor................................................................................................................................. 647 show lb monitor....................................................................................................................................647 add lb route...........................................................................................................................................652 rm lb route............................................................................................................................................ 653 show lb route........................................................................................................................................ 653 add lb route6.........................................................................................................................................654 rm lb route6.......................................................................................................................................... 654 show lb route6...................................................................................................................................... 654 add lb vserver....................................................................................................................................... 655 rm lb vserver.........................................................................................................................................662 set lb vserver.........................................................................................................................................662 unset lb vserver.....................................................................................................................................668 bind lb vserver...................................................................................................................................... 669 unbind lb vserver.................................................................................................................................. 669 enable lb vserver...................................................................................................................................670 disable lb vserver..................................................................................................................................670 show lb vserver.....................................................................................................................................671 stat lb vserver....................................................................................................................................... 677 rename lb vserver................................................................................................................................. 679 add lb metricTable................................................................................................................................680 rm lb metricTable................................................................................................................................. 680 set lb metricTable................................................................................................................................. 681 bind lb metricTable.............................................................................................................................. 681 unbind lb metricTable.......................................................................................................................... 682 show lb metricTable............................................................................................................................. 682 add lb wlm............................................................................................................................................ 683 rm lb wlm............................................................................................................................................. 684 set lb wlm............................................................................................................................................. 684 unset lb wlm......................................................................................................................................... 685 show lb wlm......................................................................................................................................... 685 bind lb wlm...........................................................................................................................................686 unbind lb wlm.......................................................................................................................................687
show lb monbindings........................................................................................................................... 687 show lb persistentSessions................................................................................................................... 688 clear lb persistentSessions.................................................................................................................... 689 set lb group........................................................................................................................................... 690 unset lb group....................................................................................................................................... 691 bind lb group........................................................................................................................................ 691 unbind lb group.................................................................................................................................... 692 show lb group....................................................................................................................................... 693 rename lb group....................................................................................................................................694 set lb sipParameters.............................................................................................................................. 694 unset lb sipParameters.......................................................................................................................... 695 show lb sipParameters.......................................................................................................................... 695 set lb parameter.................................................................................................................................... 696 unset lb parameter................................................................................................................................ 697 show lb parameter................................................................................................................................ 697
Chapter 26: Network commands...............................................................699

add arp.................................................................................................................................................. 703 rm arp................................................................................................................................................... 703 send arp................................................................................................................................................ 704 show arp............................................................................................................................................... 704 add channel...........................................................................................................................................705 rm channel............................................................................................................................................ 706 set channel............................................................................................................................................ 707 unset channel........................................................................................................................................ 708 bind channel......................................................................................................................................... 708 unbind channel..................................................................................................................................... 709 show channel........................................................................................................................................ 709 add fis................................................................................................................................................... 714 rm fis.................................................................................................................................................... 714 bind fis..................................................................................................................................................715 unbind fis..............................................................................................................................................715 show fis................................................................................................................................................ 716 add route............................................................................................................................................... 717 clear route............................................................................................................................................. 718 rm route................................................................................................................................................ 718 set route................................................................................................................................................ 719 unset route............................................................................................................................................ 720 show route............................................................................................................................................ 720 add vlan................................................................................................................................................ 723 rm vlan..................................................................................................................................................724 set vlan..................................................................................................................................................724 unset vlan..............................................................................................................................................725 bind vlan............................................................................................................................................... 726 unbind vlan........................................................................................................................................... 726 show vlan..............................................................................................................................................727 stat vlan................................................................................................................................................ 728 add vrID................................................................................................................................................729 rm vrID................................................................................................................................................. 730 set vrID................................................................................................................................................. 731 unset vrID............................................................................................................................................. 732 bind vrID.............................................................................................................................................. 732 unbind vrID.......................................................................................................................................... 733 show vrID............................................................................................................................................. 734 add vrID6..............................................................................................................................................735
rm vrID6............................................................................................................................................... 736 bind vrID6............................................................................................................................................ 736 unbind vrID6........................................................................................................................................ 737 show vrID6........................................................................................................................................... 737 add route6............................................................................................................................................. 738 clear route6........................................................................................................................................... 739 rm route6.............................................................................................................................................. 740 set route6.............................................................................................................................................. 740 unset route6.......................................................................................................................................... 741 show route6.......................................................................................................................................... 741 add nd6................................................................................................................................................. 744 clear nd6............................................................................................................................................... 744 rm nd6.................................................................................................................................................. 745 show nd6.............................................................................................................................................. 745 add inat................................................................................................................................................. 746 rm inat.................................................................................................................................................. 747 set inat.................................................................................................................................................. 748 unset inat.............................................................................................................................................. 748 show inat.............................................................................................................................................. 749 add bridgegroup....................................................................................................................................750 rm bridgegroup..................................................................................................................................... 751 set bridgegroup..................................................................................................................................... 751 unset bridgegroup................................................................................................................................. 752 bind bridgegroup.................................................................................................................................. 752 unbind bridgegroup.............................................................................................................................. 753 show bridgegroup................................................................................................................................. 753 add ipTunnel.........................................................................................................................................755 rm ipTunnel.......................................................................................................................................... 755 show ipTunnel...................................................................................................................................... 756 add ip6Tunnel.......................................................................................................................................757 rm ip6Tunnel........................................................................................................................................ 758 show ip6Tunnel.................................................................................................................................... 758 add netbridge........................................................................................................................................ 759 rm netbridge......................................................................................................................................... 759 show netbridge..................................................................................................................................... 760 bind netbridge.......................................................................................................................................761 unbind netbridge...................................................................................................................................761 add ipset................................................................................................................................................762 rm ipset................................................................................................................................................. 762 bind ipset.............................................................................................................................................. 763 unbind ipset.......................................................................................................................................... 763 show ipset............................................................................................................................................. 764 add linkset............................................................................................................................................ 764 rm linkset..............................................................................................................................................765 bind linkset........................................................................................................................................... 765 unbind linkset....................................................................................................................................... 766 show linkset..........................................................................................................................................766 add netProfile....................................................................................................................................... 767 rm netProfile.........................................................................................................................................767 set netProfile.........................................................................................................................................768 unset netProfile.....................................................................................................................................768 show netProfile.....................................................................................................................................769 set arpparam......................................................................................................................................... 769 unset arpparam..................................................................................................................................... 770 show arpparam..................................................................................................................................... 770 show ci..................................................................................................................................................770
clear interface....................................................................................................................................... 771 set interface.......................................................................................................................................... 772 unset interface...................................................................................................................................... 774 enable interface.................................................................................................................................... 774 disable interface....................................................................................................................................775 reset interface....................................................................................................................................... 775 show interface...................................................................................................................................... 776 stat interface......................................................................................................................................... 782 clear rnat............................................................................................................................................... 785 set rnat.................................................................................................................................................. 785 unset rnat.............................................................................................................................................. 786 stat rnat................................................................................................................................................. 786 show rnat.............................................................................................................................................. 787 set bridgetable...................................................................................................................................... 788 unset bridgetable.................................................................................................................................. 788 show bridgetable.................................................................................................................................. 789 clear bridgetable................................................................................................................................... 789 stat bridge............................................................................................................................................. 790 set lacp..................................................................................................................................................791 show lacp..............................................................................................................................................791 set rnatparam........................................................................................................................................ 792 unset rnatparam.................................................................................................................................... 792 show rnatparam.................................................................................................................................... 792 stat rnatip.............................................................................................................................................. 793 set vrIDParam.......................................................................................................................................794 unset vrIDParam...................................................................................................................................794 show vrIDParam...................................................................................................................................795 set ipv6................................................................................................................................................. 795 unset ipv6............................................................................................................................................. 796 show ipv6............................................................................................................................................. 796 set ipTunnelParam................................................................................................................................797 unset ipTunnelParam............................................................................................................................797 show ipTunnelParam............................................................................................................................798 set ip6TunnelParam..............................................................................................................................799 unset ip6TunnelParam..........................................................................................................................799 show ip6TunnelParam..........................................................................................................................800 set L2Param..........................................................................................................................................800 unset L2Param......................................................................................................................................802 show L2Param......................................................................................................................................802 set L3Param..........................................................................................................................................803 unset L3Param......................................................................................................................................804 show L3Param......................................................................................................................................804 add forwardingSession......................................................................................................................... 805 set forwardingSession.......................................................................................................................... 806 rm forwardingSession.......................................................................................................................... 806 show forwardingSession...................................................................................................................... 807 add rnat6............................................................................................................................................... 808 bind rnat6..............................................................................................................................................808 unbind rnat6..........................................................................................................................................809 set rnat6................................................................................................................................................ 809 unset rnat6............................................................................................................................................ 810 clear rnat6............................................................................................................................................. 810 show rnat6............................................................................................................................................ 811
Chapter 27: Ns Commands........................................................................ 813
shutdown.............................................................................................................................................. 817 reboot....................................................................................................................................................817 config ns............................................................................................................................................... 817 stat ns....................................................................................................................................................818 add ns limitIdentifier............................................................................................................................ 822 rm ns limitIdentifier............................................................................................................................. 823 set ns limitIdentifier............................................................................................................................. 824 unset ns limitIdentifier......................................................................................................................... 825 show ns limitIdentifier......................................................................................................................... 825 add ns limitSelector.............................................................................................................................. 827 rm ns limitSelector............................................................................................................................... 827 set ns limitSelector............................................................................................................................... 827 unset ns limitSelector........................................................................................................................... 828 show ns limitSelector........................................................................................................................... 828 add ns acl.............................................................................................................................................. 829 rm ns acl............................................................................................................................................... 830 set ns acl............................................................................................................................................... 831 unset ns acl........................................................................................................................................... 832 enable ns acl......................................................................................................................................... 833 disable ns acl........................................................................................................................................ 834 stat ns acl.............................................................................................................................................. 834 rename ns acl........................................................................................................................................ 835 show ns acl........................................................................................................................................... 836 add ns acl6............................................................................................................................................ 838 rm ns acl6............................................................................................................................................. 839 set ns acl6............................................................................................................................................. 840 unset ns acl6......................................................................................................................................... 841 enable ns acl6....................................................................................................................................... 842 disable ns acl6...................................................................................................................................... 842 stat ns acl6............................................................................................................................................ 843 rename ns acl6...................................................................................................................................... 844 show ns acl6......................................................................................................................................... 845 add ns ip6............................................................................................................................................. 846 rm ns ip6...............................................................................................................................................848 set ns ip6...............................................................................................................................................849 unset ns ip6...........................................................................................................................................850 show ns ip6...........................................................................................................................................851 add ns ip............................................................................................................................................... 853 rm ns ip.................................................................................................................................................855 set ns ip.................................................................................................................................................855 unset ns ip.............................................................................................................................................857 enable ns ip...........................................................................................................................................858 disable ns ip.......................................................................................................................................... 858 show ns ip.............................................................................................................................................859 add ns simpleacl................................................................................................................................... 861 clear ns simpleacl................................................................................................................................. 862 rm ns simpleacl.....................................................................................................................................862 flush ns simpleacl................................................................................................................................. 863 show ns simpleacl.................................................................................................................................863 stat ns simpleacl................................................................................................................................... 864 add ns simpleacl6................................................................................................................................. 865 clear ns simpleacl6............................................................................................................................... 865 flush ns simpleacl6............................................................................................................................... 866 rm ns simpleacl6...................................................................................................................................866 show ns simpleacl6...............................................................................................................................867 stat ns simpleacl6................................................................................................................................. 868
add ns pbr............................................................................................................................................. 869 rm ns pbr...............................................................................................................................................870 set ns pbr...............................................................................................................................................870 unset ns pbr...........................................................................................................................................872 enable ns pbr.........................................................................................................................................872 disable ns pbr........................................................................................................................................873 stat ns pbr............................................................................................................................................. 873 show ns pbr...........................................................................................................................................874 add ns xmlnamespace...........................................................................................................................877 rm ns xmlnamespace............................................................................................................................ 877 set ns xmlnamespace............................................................................................................................ 878 unset ns xmlnamespace........................................................................................................................ 878 show ns xmlnamespace........................................................................................................................ 879 add ns tcpProfile...................................................................................................................................879 rm ns tcpProfile.................................................................................................................................... 881 set ns tcpProfile.................................................................................................................................... 881 unset ns tcpProfile................................................................................................................................ 883 show ns tcpProfile................................................................................................................................ 883 add ns httpProfile................................................................................................................................. 885 rm ns httpProfile...................................................................................................................................887 set ns httpProfile...................................................................................................................................887 unset ns httpProfile...............................................................................................................................889 show ns httpProfile...............................................................................................................................889 add ns appflowCollector.......................................................................................................................891 rm ns appflowCollector........................................................................................................................ 891 show ns appflowCollector.................................................................................................................... 892 show ns stats.........................................................................................................................................892 show ns ns.conf.................................................................................................................................... 893 show ns savedConfig............................................................................................................................893 show ns runningConfig........................................................................................................................ 893 renumber ns acls...................................................................................................................................894 clear ns acls.......................................................................................................................................... 894 apply ns acls......................................................................................................................................... 894 show ns info......................................................................................................................................... 895 show ns license.....................................................................................................................................895 show ns version.................................................................................................................................... 897 clear ns config...................................................................................................................................... 898 set ns config..........................................................................................................................................898 unset ns config......................................................................................................................................903 save ns config....................................................................................................................................... 903 show ns config......................................................................................................................................904 diff ns config........................................................................................................................................ 906 set ns param.......................................................................................................................................... 906 unset ns param...................................................................................................................................... 911 show ns param...................................................................................................................................... 911 clear ns acls6........................................................................................................................................ 912 apply ns acls6....................................................................................................................................... 912 renumber ns acls6.................................................................................................................................913 renumber ns pbrs.................................................................................................................................. 913 clear ns pbrs..........................................................................................................................................914 apply ns pbrs.........................................................................................................................................914 show ns connectiontable.......................................................................................................................914 show ns limitSessions...........................................................................................................................919 clear ns limitSessions........................................................................................................................... 920 show ns persistencesession...................................................................................................................921 clear ns persistencesession................................................................................................................... 922
set ns hostName....................................................................................................................................922 show ns hostName................................................................................................................................922 flush ns surgeQ.....................................................................................................................................923 enable ns feature...................................................................................................................................923 disable ns feature.................................................................................................................................. 924 show ns feature.....................................................................................................................................924 enable ns mode..................................................................................................................................... 926 disable ns mode.................................................................................................................................... 926 show ns mode....................................................................................................................................... 926 set ns dhcpParams................................................................................................................................ 928 unset ns dhcpParams............................................................................................................................ 928 show ns dhcpParams............................................................................................................................ 928 release ns dhcpIp.................................................................................................................................. 929 set ns spParams.....................................................................................................................................929 unset ns spParams.................................................................................................................................930 show ns spParams.................................................................................................................................930 set ns tcpbufParam............................................................................................................................... 931 unset ns tcpbufParam........................................................................................................................... 931 show ns tcpbufParam........................................................................................................................... 932 set ns tcpParam.....................................................................................................................................932 unset ns tcpParam.................................................................................................................................934 show ns tcpParam.................................................................................................................................935 set ns httpParam................................................................................................................................... 936 unset ns httpParam............................................................................................................................... 937 show ns httpParam............................................................................................................................... 938 set ns weblogparam.............................................................................................................................. 938 show ns weblogparam.......................................................................................................................... 939 set ns rateControl..................................................................................................................................939 unset ns rateControl..............................................................................................................................940 show ns rateControl..............................................................................................................................940 set ns rpcNode...................................................................................................................................... 941 unset ns rpcNode.................................................................................................................................. 941 show ns rpcNode.................................................................................................................................. 942 set ns idletimeout..................................................................................................................................943 unset ns idletimeout..............................................................................................................................943 show ns idletimeout..............................................................................................................................943 set ns timeout........................................................................................................................................944 unset ns timeout....................................................................................................................................945 show ns timeout....................................................................................................................................946 show ns hardware................................................................................................................................. 947 show ns events......................................................................................................................................947 set ns encryptionParams....................................................................................................................... 948 show ns encryptionParams................................................................................................................... 949 show ns rollbackcmd............................................................................................................................ 949 stat ns memory..................................................................................................................................... 950 set ns appflowParam.............................................................................................................................950 unset ns appflowParam.........................................................................................................................951 show ns appflowParam.........................................................................................................................952 add ns pbr6........................................................................................................................................... 953 renumber ns pbr6..................................................................................................................................954 rm ns pbr6.............................................................................................................................................955 set ns pbr6.............................................................................................................................................955 unset ns pbr6.........................................................................................................................................957 enable ns pbr6.......................................................................................................................................957 disable ns pbr6......................................................................................................................................958 stat ns pbr6........................................................................................................................................... 958
show ns pbr6.........................................................................................................................................959 clear ns pbr6......................................................................................................................................... 962 apply ns pbr6........................................................................................................................................ 962
Chapter 28: Ntp Commands...................................................................... 965

add ntp server....................................................................................................................................... 966 rm ntp server.........................................................................................................................................966 set ntp server.........................................................................................................................................967 unset ntp server.....................................................................................................................................968 show ntp server.....................................................................................................................................968 enable ntp sync..................................................................................................................................... 969 disable ntp sync.................................................................................................................................... 969 show ntp sync....................................................................................................................................... 970 show ntp status..................................................................................................................................... 970 set ntp param........................................................................................................................................ 970 unset ntp param.................................................................................................................................... 971 show ntp param.................................................................................................................................... 971
Chapter 29: Policy Commands.................................................................. 973

add policy expression........................................................................................................................... 974 rm policy expression............................................................................................................................ 974 set policy expression............................................................................................................................ 975 unset policy expression........................................................................................................................ 975 show policy expression........................................................................................................................ 976 add policy map..................................................................................................................................... 977 rm policy map.......................................................................................................................................978 show policy map...................................................................................................................................978 add policy patClass...............................................................................................................................979 rm policy patClass................................................................................................................................ 980 bind policy patClass............................................................................................................................. 980 unbind policy patClass......................................................................................................................... 981 show policy patClass............................................................................................................................ 981 add policy patset...................................................................................................................................982 rm policy patset.................................................................................................................................... 983 bind policy patset................................................................................................................................. 983 unbind policy patset............................................................................................................................. 984 show policy patset................................................................................................................................ 984 add policy dataset................................................................................................................................. 985 rm policy dataset.................................................................................................................................. 985 bind policy dataset................................................................................................................................986 unbind policy dataset............................................................................................................................986 show policy dataset.............................................................................................................................. 987 add policy httpCallout.......................................................................................................................... 988 rm policy httpCallout........................................................................................................................... 988 set policy httpCallout........................................................................................................................... 989 unset policy httpCallout....................................................................................................................... 990 show policy httpCallout....................................................................................................................... 991 add policy stringmap............................................................................................................................ 992 rm policy stringmap............................................................................................................................. 993 set policy stringmap............................................................................................................................. 993 unset policy stringmap......................................................................................................................... 994 bind policy stringmap...........................................................................................................................994 unbind policy stringmap.......................................................................................................................995 show policy stringmap......................................................................................................................... 996
Chapter 30: Pq Commands........................................................................997

stat pq................................................................................................................................................... 998 add pq policy........................................................................................................................................ 998 rm pq policy......................................................................................................................................... 999 set pq policy....................................................................................................................................... 1000 unset pq policy................................................................................................................................... 1000 show pq policy................................................................................................................................... 1001 stat pq policy...................................................................................................................................... 1002 show pq binding................................................................................................................................. 1003 show pq stats...................................................................................................................................... 1004
Chapter 31: Protocol Commands............................................................ 1005

stat protocol tcp.................................................................................................................................. 1006 stat protocol http.................................................................................................................................1010 stat protocol icmp............................................................................................................................... 1012 stat protocol ipv6................................................................................................................................ 1014 stat protocol icmpv6........................................................................................................................... 1016 stat protocol ip.................................................................................................................................... 1018 stat protocol udp................................................................................................................................. 1020 set protocol httpBand......................................................................................................................... 1021 unset protocol httpBand..................................................................................................................... 1021 show protocol httpBand..................................................................................................................... 1022
Chapter 32: Responder Commands........................................................ 1025

add responder policy.......................................................................................................................... 1026 rm responder policy............................................................................................................................1026 set responder policy............................................................................................................................1027 unset responder policy........................................................................................................................1028 show responder policy........................................................................................................................1028 rename responder policy.................................................................................................................... 1030 stat responder policy...........................................................................................................................1030 add responder action...........................................................................................................................1031 rm responder action............................................................................................................................ 1032 set responder action............................................................................................................................ 1032 unset responder action........................................................................................................................ 1033 show responder action........................................................................................................................ 1034 rename responder action.....................................................................................................................1035 add responder policylabel...................................................................................................................1035 rm responder policylabel.................................................................................................................... 1036 bind responder policylabel................................................................................................................. 1036 unbind responder policylabel............................................................................................................. 1037 show responder policylabel................................................................................................................ 1037 stat responder policylabel...................................................................................................................1039 rename responder policylabel.............................................................................................................1039 bind responder global......................................................................................................................... 1040 unbind responder global..................................................................................................................... 1040 show responder global........................................................................................................................1041 set responder param............................................................................................................................1042 unset responder param........................................................................................................................1042 show responder param........................................................................................................................1043 import responder htmlpage.................................................................................................................1043 rm responder htmlpage.......................................................................................................................1044
update responder htmlpage.................................................................................................................1044 show responder htmlpage...................................................................................................................1045
Chapter 33: Rewrite Commands.............................................................1047

add rewrite policy...............................................................................................................................1048 rm rewrite policy................................................................................................................................ 1048 set rewrite policy................................................................................................................................ 1049 unset rewrite policy............................................................................................................................ 1050 show rewrite policy............................................................................................................................ 1050 stat rewrite policy............................................................................................................................... 1051 rename rewrite policy.........................................................................................................................1052 add rewrite action............................................................................................................................... 1053 rm rewrite action................................................................................................................................ 1055 set rewrite action................................................................................................................................ 1055 unset rewrite action............................................................................................................................ 1056 show rewrite action............................................................................................................................ 1057 rename rewrite action......................................................................................................................... 1059 add rewrite policylabel....................................................................................................................... 1059 rm rewrite policylabel........................................................................................................................ 1060 bind rewrite policylabel......................................................................................................................1060 unbind rewrite policylabel..................................................................................................................1061 show rewrite policylabel.................................................................................................................... 1061 stat rewrite policylabel....................................................................................................................... 1063 rename rewrite policylabel................................................................................................................. 1063 bind rewrite global............................................................................................................................. 1064 unbind rewrite global......................................................................................................................... 1064 show rewrite global............................................................................................................................ 1065 set rewrite param................................................................................................................................ 1066 unset rewrite param............................................................................................................................ 1066 show rewrite param............................................................................................................................ 1067
Chapter 34: Router Commands.............................................................. 1069

vtysh................................................................................................................................................... 1070 add router bgp.....................................................................................................................................1070 clear router bgp...................................................................................................................................1071 rm router bgp...................................................................................................................................... 1071 set router bgp...................................................................................................................................... 1072 unset router bgp.................................................................................................................................. 1073 show router bgp.................................................................................................................................. 1073 set router ospf..................................................................................................................................... 1074 unset router ospf................................................................................................................................. 1075 show router ospf................................................................................................................................. 1075 set router rip....................................................................................................................................... 1076 unset router rip................................................................................................................................... 1076 show router rip................................................................................................................................... 1077
Chapter 35: Sc Commands...................................................................... 1079

stat sc.................................................................................................................................................. 1080 add sc policy.......................................................................................................................................1080 rm sc policy........................................................................................................................................ 1082 set sc policy........................................................................................................................................ 1082 unset sc policy.................................................................................................................................... 1083 show sc policy.................................................................................................................................... 1084
stat sc policy....................................................................................................................................... 1085 show sc stats....................................................................................................................................... 1086 set sc parameter.................................................................................................................................. 1087 unset sc parameter.............................................................................................................................. 1087 show sc parameter.............................................................................................................................. 1088
Chapter 36: Snmp Commands................................................................ 1089

stat snmp.............................................................................................................................................1091 add snmp community......................................................................................................................... 1092 rm snmp community...........................................................................................................................1092 show snmp community.......................................................................................................................1093 add snmp manager..............................................................................................................................1093 rm snmp manager............................................................................................................................... 1094 set snmp manager............................................................................................................................... 1095 unset snmp manager........................................................................................................................... 1095 show snmp manager........................................................................................................................... 1096 add snmp trap..................................................................................................................................... 1096 rm snmp trap.......................................................................................................................................1097 set snmp trap.......................................................................................................................................1098 unset snmp trap...................................................................................................................................1099 show snmp trap...................................................................................................................................1099 add snmp group.................................................................................................................................. 1100 rm snmp group................................................................................................................................... 1100 set snmp group................................................................................................................................... 1101 show snmp group............................................................................................................................... 1101 add snmp view....................................................................................................................................1102 rm snmp view..................................................................................................................................... 1103 set snmp view..................................................................................................................................... 1103 show snmp view................................................................................................................................. 1104 add snmp user.....................................................................................................................................1104 rm snmp user...................................................................................................................................... 1105 set snmp user...................................................................................................................................... 1105 unset snmp user.................................................................................................................................. 1106 show snmp user.................................................................................................................................. 1106 show snmp oid....................................................................................................................................1107 show snmp stats..................................................................................................................................1108 set snmp alarm....................................................................................................................................1108 unset snmp alarm................................................................................................................................1110 enable snmp alarm..............................................................................................................................1110 disable snmp alarm.............................................................................................................................1111 show snmp alarm................................................................................................................................1112 set snmp mib.......................................................................................................................................1113 unset snmp mib...................................................................................................................................1114 show snmp mib...................................................................................................................................1114 set snmp engineId...............................................................................................................................1115 unset snmp engineId...........................................................................................................................1115 show snmp engineId...........................................................................................................................1116 set snmp option...................................................................................................................................1116 unset snmp option...............................................................................................................................1117 show snmp option...............................................................................................................................1117
Chapter 37: Ssl Commands......................................................................1119

stat ssl................................................................................................................................................. 1121 create ssl fipsKey............................................................................................................................... 1126
rm ssl fipsKey.....................................................................................................................................1127 show ssl fipsKey.................................................................................................................................1127 import ssl fipsKey.............................................................................................................................. 1128 export ssl fipsKey...............................................................................................................................1129 create ssl wrapkey.............................................................................................................................. 1130 rm ssl wrapkey................................................................................................................................... 1130 show ssl wrapkey............................................................................................................................... 1131 add ssl certKey................................................................................................................................... 1131 rm ssl certKey.....................................................................................................................................1133 set ssl certKey.....................................................................................................................................1133 unset ssl certKey.................................................................................................................................1134 bind ssl certKey.................................................................................................................................. 1134 unbind ssl certKey.............................................................................................................................. 1135 link ssl certKey...................................................................................................................................1136 unlink ssl certKey...............................................................................................................................1137 show ssl certKey.................................................................................................................................1138 update ssl certKey.............................................................................................................................. 1140 add ssl cipher...................................................................................................................................... 1141 bind ssl cipher.....................................................................................................................................1141 show ssl cipher................................................................................................................................... 1142 rm ssl cipher....................................................................................................................................... 1143 add ssl crl............................................................................................................................................1144 create ssl crl........................................................................................................................................ 1146 rm ssl crl............................................................................................................................................. 1147 set ssl crl............................................................................................................................................. 1147 unset ssl crl......................................................................................................................................... 1149 show ssl crl......................................................................................................................................... 1149 add ssl action...................................................................................................................................... 1151 rm ssl action....................................................................................................................................... 1152 show ssl action................................................................................................................................... 1153 add ssl policy...................................................................................................................................... 1155 rm ssl policy....................................................................................................................................... 1155 set ssl policy....................................................................................................................................... 1156 unset ssl policy................................................................................................................................... 1156 show ssl policy................................................................................................................................... 1157 add ssl policylabel.............................................................................................................................. 1158 rm ssl policylabel............................................................................................................................... 1159 bind ssl policylabel.............................................................................................................................1159 unbind ssl policylabel.........................................................................................................................1160 show ssl policylabel........................................................................................................................... 1160 add ssl ocspResponder....................................................................................................................... 1161 rm ssl ocspResponder.........................................................................................................................1163 set ssl ocspResponder.........................................................................................................................1163 unset ssl ocspResponder.....................................................................................................................1164 show ssl ocspResponder.....................................................................................................................1165 create ssl rsakey..................................................................................................................................1166 convert ssl pkcs12.............................................................................................................................. 1167 convert ssl pkcs8................................................................................................................................ 1168 create ssl dhParam.............................................................................................................................. 1168 create ssl dsaKey................................................................................................................................ 1169 show ssl certLink................................................................................................................................1170 create ssl certReq................................................................................................................................1170 create ssl cert...................................................................................................................................... 1172 show ssl stats...................................................................................................................................... 1173 set ssl parameter................................................................................................................................. 1174 unset ssl parameter............................................................................................................................. 1175
show ssl parameter............................................................................................................................. 1176 set ssl fips........................................................................................................................................... 1177 unset ssl fips....................................................................................................................................... 1178 reset ssl fips........................................................................................................................................ 1178 show ssl fips....................................................................................................................................... 1178 update ssl fips..................................................................................................................................... 1180 set ssl service...................................................................................................................................... 1180 unset ssl service.................................................................................................................................. 1182 bind ssl service................................................................................................................................... 1183 unbind ssl service............................................................................................................................... 1183 show ssl service.................................................................................................................................. 1184 set ssl serviceGroup............................................................................................................................1186 unset ssl serviceGroup........................................................................................................................1187 show ssl serviceGroup........................................................................................................................1187 set ssl vserver..................................................................................................................................... 1190 unset ssl vserver................................................................................................................................. 1192 bind ssl vserver...................................................................................................................................1192 unbind ssl vserver...............................................................................................................................1193 show ssl vserver................................................................................................................................. 1193 enable ssl fipsSIMTarget....................................................................................................................1196 init ssl fipsSIMTarget.........................................................................................................................1196 enable ssl fipsSIMSource................................................................................................................... 1197 init ssl fipsSIMSource........................................................................................................................ 1197 bind ssl global.....................................................................................................................................1198 unbind ssl global.................................................................................................................................1198 show ssl global................................................................................................................................... 1198
Chapter 38: Stream Commands.............................................................. 1201

add stream selector............................................................................................................................. 1202 set stream selector.............................................................................................................................. 1202 rm stream selector.............................................................................................................................. 1203 show stream selector.......................................................................................................................... 1203 add stream identifier...........................................................................................................................1204 set stream identifier............................................................................................................................ 1204 unset stream identifier........................................................................................................................ 1205 rm stream identifier............................................................................................................................ 1205 show stream identifier........................................................................................................................ 1206 stat stream identifier........................................................................................................................... 1207 clear stream session............................................................................................................................ 1208
Chapter 39: System Commands.............................................................. 1209

stat system.......................................................................................................................................... 1211 add system cmdPolicy........................................................................................................................ 1216 rm system cmdPolicy......................................................................................................................... 1216 set system cmdPolicy......................................................................................................................... 1217 show system cmdPolicy..................................................................................................................... 1217 add system user.................................................................................................................................. 1218 rm system user....................................................................................................................................1219 set system user....................................................................................................................................1219 unset system user................................................................................................................................1220 bind system user................................................................................................................................. 1220 unbind system user............................................................................................................................. 1220 show system user................................................................................................................................1221 add system group................................................................................................................................1222
rm system group................................................................................................................................. 1222 bind system group.............................................................................................................................. 1223 unbind system group.......................................................................................................................... 1223 show system group............................................................................................................................. 1224 set system group................................................................................................................................. 1225 unset system group............................................................................................................................. 1225 show system session...........................................................................................................................1226 kill system session.............................................................................................................................. 1226 stat system cpu................................................................................................................................... 1227 stat system memory............................................................................................................................ 1227 rm system entitydata...........................................................................................................................1228 show system entitydata.......................................................................................................................1229 show system entity............................................................................................................................. 1230 show system globaldata......................................................................................................................1230 show system counters.........................................................................................................................1231 show system countergroup................................................................................................................. 1231 show system eventhistory...................................................................................................................1232 show system core............................................................................................................................... 1232 show system dataSource.....................................................................................................................1233 bind system global..............................................................................................................................1233 unbind system global..........................................................................................................................1233 show system global............................................................................................................................ 1234 set system collectionparam.................................................................................................................1235 unset system collectionparam.............................................................................................................1235 show system collectionparam.............................................................................................................1235 set system parameter.......................................................................................................................... 1236 unset system parameter...................................................................................................................... 1237 show system parameter...................................................................................................................... 1237
Chapter 40: TM Commands.................................................................... 1239

add tm sessionPolicy.......................................................................................................................... 1240 rm tm sessionPolicy........................................................................................................................... 1240 set tm sessionPolicy........................................................................................................................... 1241 unset tm sessionPolicy....................................................................................................................... 1241 show tm sessionPolicy....................................................................................................................... 1242 add tm sessionAction......................................................................................................................... 1243 rm tm sessionAction...........................................................................................................................1243 set tm sessionAction...........................................................................................................................1244 unset tm sessionAction.......................................................................................................................1245 show tm sessionAction.......................................................................................................................1245 add tm trafficPolicy............................................................................................................................ 1246 rm tm trafficPolicy............................................................................................................................. 1247 set tm trafficPolicy............................................................................................................................. 1247 unset tm trafficPolicy......................................................................................................................... 1248 show tm trafficPolicy......................................................................................................................... 1248 add tm formSSOAction...................................................................................................................... 1249 rm tm formSSOAction....................................................................................................................... 1250 set tm formSSOAction....................................................................................................................... 1251 unset tm formSSOAction................................................................................................................... 1252 show tm formSSOAction................................................................................................................... 1252 add tm trafficAction........................................................................................................................... 1253 rm tm trafficAction.............................................................................................................................1254 set tm trafficAction.............................................................................................................................1254 unset tm trafficAction.........................................................................................................................1255 show tm trafficAction.........................................................................................................................1255
bind tm global.....................................................................................................................................1256 unbind tm global.................................................................................................................................1257 show tm global................................................................................................................................... 1257 set tm sessionParameter..................................................................................................................... 1258 unset tm sessionParameter................................................................................................................. 1259 show tm sessionParameter................................................................................................................. 1259
Chapter 41: Tunnel Commands.............................................................. 1261

add tunnel trafficPolicy...................................................................................................................... 1262 rm tunnel trafficPolicy....................................................................................................................... 1262 set tunnel trafficPolicy....................................................................................................................... 1263 unset tunnel trafficPolicy................................................................................................................... 1263 show tunnel trafficPolicy................................................................................................................... 1264 bind tunnel global...............................................................................................................................1265 unbind tunnel global...........................................................................................................................1266 show tunnel global............................................................................................................................. 1266
Chapter 42: Transform Commands........................................................1269

add transform profile.......................................................................................................................... 1270 rm transform profile........................................................................................................................... 1270 set transform profile........................................................................................................................... 1270 unset transform profile....................................................................................................................... 1271 show transform profile....................................................................................................................... 1271 add transform action...........................................................................................................................1273 rm transform action............................................................................................................................ 1274 set transform action............................................................................................................................ 1274 unset transform action........................................................................................................................ 1275 show transform action........................................................................................................................ 1275 add transform policy...........................................................................................................................1277 rm transform policy............................................................................................................................ 1277 set transform policy............................................................................................................................ 1278 unset transform policy........................................................................................................................ 1279 show transform policy........................................................................................................................ 1279 stat transform policy...........................................................................................................................1280 rename transform policy.....................................................................................................................1281 add transform policylabel...................................................................................................................1282 rm transform policylabel.................................................................................................................... 1282 bind transform policylabel................................................................................................................. 1283 unbind transform policylabel............................................................................................................. 1283 show transform policylabel................................................................................................................ 1284 stat transform policylabel................................................................................................................... 1285 rename transform policylabel.............................................................................................................1286 bind transform global......................................................................................................................... 1286 unbind transform global..................................................................................................................... 1287 show transform global........................................................................................................................ 1287
Chapter 43: Utility Commands................................................................1289

nstrace.................................................................................................................................................1290 scp.......................................................................................................................................................1291 shell.................................................................................................................................................... 1291 install.................................................................................................................................................. 1292 grep.....................................................................................................................................................1292 traceroute6.......................................................................................................................................... 1293
traceroute............................................................................................................................................ 1294 ping6...................................................................................................................................................1295 ping.....................................................................................................................................................1296 show techsupport................................................................................................................................1297 config audit.........................................................................................................................................1297 show callhome....................................................................................................................................1298 set callhome........................................................................................................................................1299 unset callhome....................................................................................................................................1299
Chapter 44: Vpn Commands................................................................... 1301

stat vpn............................................................................................................................................... 1303 add vpn vserver.................................................................................................................................. 1304 rm vpn vserver....................................................................................................................................1306 set vpn vserver....................................................................................................................................1307 unset vpn vserver................................................................................................................................1308 bind vpn vserver................................................................................................................................. 1309 unbind vpn vserver............................................................................................................................. 1309 enable vpn vserver..............................................................................................................................1310 disable vpn vserver.............................................................................................................................1310 show vpn vserver................................................................................................................................1311 stat vpn vserver...................................................................................................................................1315 rename vpn vserver............................................................................................................................ 1316 add vpn intranetApplication............................................................................................................... 1317 rm vpn intranetApplication................................................................................................................ 1317 show vpn intranetApplication............................................................................................................ 1318 add vpn nextHopServer...................................................................................................................... 1319 rm vpn nextHopServer....................................................................................................................... 1319 show vpn nextHopServer................................................................................................................... 1320 add vpn trafficPolicy.......................................................................................................................... 1320 rm vpn trafficPolicy........................................................................................................................... 1321 set vpn trafficPolicy........................................................................................................................... 1321 unset vpn trafficPolicy....................................................................................................................... 1322 show vpn trafficPolicy....................................................................................................................... 1322 add vpn trafficAction......................................................................................................................... 1323 rm vpn trafficAction...........................................................................................................................1324 set vpn trafficAction...........................................................................................................................1325 unset vpn trafficAction.......................................................................................................................1325 show vpn trafficAction.......................................................................................................................1326 add vpn formSSOAction.................................................................................................................... 1327 rm vpn formSSOAction..................................................................................................................... 1328 set vpn formSSOAction..................................................................................................................... 1328 unset vpn formSSOAction................................................................................................................. 1329 show vpn formSSOAction................................................................................................................. 1329 add vpn url..........................................................................................................................................1330 rm vpn url........................................................................................................................................... 1331 set vpn url........................................................................................................................................... 1331 unset vpn url....................................................................................................................................... 1332 show vpn url....................................................................................................................................... 1332 add vpn sessionPolicy........................................................................................................................ 1333 rm vpn sessionPolicy..........................................................................................................................1334 set vpn sessionPolicy..........................................................................................................................1334 unset vpn sessionPolicy......................................................................................................................1335 show vpn sessionPolicy......................................................................................................................1335 add vpn sessionAction........................................................................................................................1336 rm vpn sessionAction......................................................................................................................... 1341
set vpn sessionAction......................................................................................................................... 1341 unset vpn sessionAction..................................................................................................................... 1346 show vpn sessionAction..................................................................................................................... 1346 add vpn clientlessAccessPolicy..........................................................................................................1350 rm vpn clientlessAccessPolicy........................................................................................................... 1350 set vpn clientlessAccessPolicy........................................................................................................... 1351 show vpn clientlessAccessPolicy....................................................................................................... 1351 add vpn clientlessAccessProfile......................................................................................................... 1352 rm vpn clientlessAccessProfile.......................................................................................................... 1353 set vpn clientlessAccessProfile.......................................................................................................... 1353 unset vpn clientlessAccessProfile...................................................................................................... 1354 show vpn clientlessAccessProfile...................................................................................................... 1355 show vpn stats.................................................................................................................................... 1356 show vpn icaConnection.................................................................................................................... 1356 bind vpn global...................................................................................................................................1357 unbind vpn global...............................................................................................................................1358 show vpn global................................................................................................................................. 1358 set vpn parameter............................................................................................................................... 1359 unset vpn parameter........................................................................................................................... 1364 show vpn parameter........................................................................................................................... 1364
Chapter 45: Wi Commands..................................................................... 1369

add wi site...........................................................................................................................................1370 rm wi site............................................................................................................................................ 1371 set wi site............................................................................................................................................ 1371 bind wi site......................................................................................................................................... 1372 unbind wi site..................................................................................................................................... 1373 show wi site........................................................................................................................................ 1374 install wi package............................................................................................................................... 1376 uninstall wi package........................................................................................................................... 1376
About the NetScaler Documentation LibraryPreface

Learn about the Citrix NetScaler collection of documentation, including information about support options and ways to send us feedback. In This Preface: Formatting Conventions for NetScaler Documentation Documentation Available on the NetScaler Appliance Getting Service and Support NetScaler Documentation Feedback
For information about new features and enhancements for this release, see the Citrix NetScaler 9.3 Release Notes at http://support.citrix.com/article/CTX128669. For information about new features and enhancements for this release, see the Citrix NetScaler 9.2 Release Notes at http://edocs.citrix.com. For more information about new features and enhancements for this release, see the Citrix NetScaler 9.1 Release Notes at http://edocs.citrix.com. Formatting Conventions for NetScaler Documentation The NetScaler documentation uses the following formatting conventions. Table 1: Formatting Conventions Convention Boldface Meaning In text paragraphs or steps in a procedure, information that you type exactly as shown (user input), or an element in the user interface. Text that appears in a command-line interface. Used for examples of command-line procedures. Also used to distinguish interface terms, such as names of directories and files, from ordinary text. A term enclosed in angle brackets is a variable placeholder, to be replaced with an appropriate value. Do not enter the angle brackets. Optional items in command statements. For example, in the following command, [ -range <positiveInteger> ] means that you have the option of entering a range, but it is not required: add lb vserver <name> <serviceType> <IPAddress> <port> [ -range <positiveInteger>] Do not type the brackets themselves. | (vertical bar) A separator between options in braces or brackets in command statements. For example, the following indicates that you choose one of the following load balancing methods: <lbMethod> = ( ROUNDROBIN | LEASTCONNECTION | LEASTRESPONSETIME | URLHASH |
Monospace
<angle brackets>
[ brackets ]
36 | Citrix NetScaler 10 | About the NetScaler Documentation LibraryPreface
Convention
Meaning DOMAINHASH | DESTINATIONIPHASH | SOURCEIPHASH | SRCIPDESTIPHASH | LEASTBANDWIDTH | LEASTPACKETS | TOKEN | SRCIPSRCPORTHASH | LRTM | CALLIDHASH | CUSTOMLOAD )
(ellipsis)
You can repeat the previous item or items in command statements. For example, / route:<DeviceName>[ ,] means you can type additional <DeviceNames> separated by commas.
Documentation Available on the NetScaler Appliance A complete set of Citrix NetScaler documentation is available on the Documentation tab of your NetScaler appliance and at http://support.citrix.com/ (PDF version), and at http://edocs.citrix.com (HTML version). (The PDF version of the documents require Adobe Reader, available at http://adobe.com/.) To view the documentation 1. From a Web browser, log on to the NetScaler Appliance. 2. Click the Documentation tab. 3. To view a short description of each document, hover the mouse pointer over the title. To open a document, click the title. Getting Service and Support Citrix offers a variety of resources for support with your Citrix environment, including the following: The Knowledge Center is a self-service, Web-based technical support database that contains thousands of technical solutions, including access to the latest hotfixes, service packs, and security bulletins. Technical Support Programs for both software support and appliance maintenance are available at a variety of support levels. The Subscription Advantage program is a one-year membership that gives you an easy way to stay current with the latest product version upgrades and enhancements. Citrix Education provides official training and certification programs on virtually all Citrix products and technologies.
For more information about Citrix services and support, see the Citrix Systems Support Web site at http:// www.citrix.com/lang/English/support.asp. You can also participate in and follow technical discussions offered by the experts on various Citrix products at the following sites: http://community.citrix.com http://twitter.com/citrixsupport http://forums.citrix.com/support
NetScaler Documentation Feedback You are encouraged to provide feedback and suggestions so that we can enhance the documentation. You can send an email to nsdocs_feedback@citrix.com. In the subject line, specify "Documentation Feedback." Please include the topic URL. To locate the topic URL, right-click the eDocs topic, and then click Properties Please include the title of the guide and the page number in the email message. You can also provide feedback through the Knowledge Center at http://support.citrix.com/. To provide feedback at the Knowledge Center home page 1. Go to the Knowledge Center home page at http://support.citrix.com/.
Citrix NetScaler 10 | About the NetScaler Documentation LibraryPreface | 37
2. On the Knowledge Center home page, under Products, expand NetScaler, and then click the NetScaler release for which you want to provide feedback. 3. On the Documentation tab, click the guide name, and then click Article Feedback. 4. On the Documentation Feedback page, complete the form, and then click Submit. Articles, Videos, and More... Articles, Videos, and More...
38 | Citrix NetScaler 10 | About the NetScaler Documentation LibraryPreface
Chapter
1
Introduction - Classic CLI
Topics: How to use This Reference Command Conventions Command Line Overview
Welcome to the Command Reference Guide. This reference covers all aspects of using the Command Line Interface in the configuration and operation of the system. For information on accessing your system's Command Line Interface, please refer to the installation chapter in the Installation and Configuration Guide before continuing on from this point. Articles, Videos and more...
40 | Citrix NetScaler 10 | Introduction - Classic CLI
How to use This Reference

This command reference consists of three chapters: Chapter 1 Chapter 2 The Command Line Overview which explains how to use the Command Line Interface. The Command Line Overview which explains how to use the Contextual Command Line Interface (CCLI). Alphabetically ordered descriptions of all of the commands.
Chapter 3
If you are unfamiliar with using the system, you should start with the CLI usage chapter to familiarize yourself with the interface after reviewing the following section on document conventions. Otherwise, this document serves as the primary source of information on the commands available in the NSCLI and may be accessed at any arbitrary point as your needs dictate. Articles, Videos and more...
Command Conventions
These conventions are used to describe the commands in this guide. Convention command Alerts You To Command and argument names can be entered in any combination of upper and lower case characters. In this document command and argument names are sometimes displayed in upper and lower case. This is for readability and does not reflect the way in which the commands must be entered. This typeface represents a command argument. Text with this typeface represents information on a screen, as well as the names of directories, files, and commands. Keyboard key names appear within angle brackets. A plus sign appears between keys you must press simultaneously. Italic type emphasizes text or indicates new terms. Arguments that are contained within square brackets are optional. Arguments that are not contained within brackets are required. Angle Brackets (< >) Arguments within angle brackets are variable place holders. Replace these with values appropriate for your configuration. When arguments are separated by vertical bars, either argument can be specified.
command argument screen text
<key name>+<key name>
text in italics Square Brackets ( [ ] )
Vertical Bars ( | )
Citrix NetScaler 10 | Introduction - Classic CLI | 41
Note: When entering the argument, neither the brackets nor the vertical bars are included. Articles, Videos and more...
Command Line Overview

This section discusses the usage of the Command Line Interface. The discussion is broken up in to two sections, basic and advanced CLI usage. The basic section covers all of the rudimentary aspects of the CLI which provides the information necessary for basic CLI usage. The advanced usage section expands on the remaining features of the Command Line Interface which allow you to further control and enhance your sessions but are not required for day to day operation. Articles, Videos and more...
Basic Command Line Usage

This section discusses the essential instruction necessary for basic command line usage with the system. Start with this section if you are unfamiliar with the CLI. Understanding the Command Structure Most commands adhere to the general format shown here. action groupname entity <entityname> [-parameter] An action is the task that the command is performing such as an add or set action. The groupname is the functional area or feature where the action is being taken such as dns or lb. An entity is the specific type of object such as a vserver that the command is being issued against. The entityname is the name given to an entity instance that the command is being issued upon. If an entity instance is being created with the issued command, such as with the add action, the entityname will be a name of your choosing. Lastly, the parameters applicable to the command are listed. The actual number and type of available parameters will vary by command. Getting Help in the CLI The help command offers a quick way to get more information on commands. The command can return help on specific commands, groups of commands, or the entire set of nscli commands. By typing help alone on the command line, the system will print a brief general help message as shown here. >help NetScaler command-line interface Try : 'help <commandName>' 'help <groupName>' 'help -all' 'man <commandName>' for for for for full usage of a specific command brief usage of a group of commands brief usage of all CLI commands a complete command description
'?' will show possible completions in the current context The command groups are: basic audit cache cr dos HA ns pq aaa authentication cli cs filter lb ntp protocol appfw authorization cmp dns gslb network policy responder
rewrite sc tm utility Done
router ssl transform vpn
snmp system tunnel
And by entering help help, you will see the following output which shows the syntax for the help command. > help help Usage: help [(commandName) | <groupName> | -all] Done If you need help on using a specific command or command group, utilize the syntax shown above substituting that command or group name you need help for.By specifying the command name, the CLI feedback will provide you with a full listing of the command's syntax along with an expansion on those parameters with limited sets of options.If you enter a group name, the CLI will print a full list of the commands that belong to that group. The output below shows an example of using this help method for the add vserver command. > add lb vserver Usage: add lb vserver <name>@ <serviceType> [(<IPAddress>@ [-range <positive_integer>]) | (-IPPattern <ippat> -IPMask <ipmask>)] [<port>] [-persistenceType <persistenceType>] [-timeout <mins>] [-persistenceBackup ( SOURCEIP | NONE )] [-backupPersistenceTimeout <mins>] [-lbMethod <lbMethod> [-hashLength <positive_integer>] [-netmask <netmask>] ] [-rule <expression>] [-resRule <expression>] [-persistMask <netmask>] [-pq ( ON | OFF )] [-sc ( ON | OFF )] [-rtspNat ( ON | OFF )] [-m <m>] [-tosId <positive_integer>] [-dataLength <positive_integer>] [-dataOffset <positive_integer>] [-sessionless ( ENABLED | DISABLED )] [-state ( ENABLED | DISABLED )] [-connfailover <connfailover>] [-redirectURL <URL>] [-cacheable ( YES | NO )] [-cltTimeout <secs>] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-redirectPortRewrite ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-backupVServer <string>] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-insertVserverIPPort <insertVserverIPPort> [<vipHeader>] ] [-AuthenticationHost <string>] [-Authentication ( ON | OFF )] [-push ( ENABLED | DISABLED )] [-pushVserver <string>] [-pushLabel <expression>] [-pushMultiClients ( YES | NO )] The question mark <?> can also be used to get help in the CLI. By typing a question mark alone, the system will print out a listing of all the actions available from the top level command structure. Getting Help with Man Pages The command line interface has its own set of man pages similar to those traditionally found in UNIX and UNIX like operating systems. This system returns the same command reference information as is found in this guide. To use this help feature, issue the man command using the name of the command you wish to view information on as the argument. Once the first screen is displayed, you may scroll through the page either a screen at a time or line by line. To advance line by line, press the <Enter> key. To advance to the next screen use the space bar. When viewing commands with man, to exit the page before reaching the end of it, <Q> key. Using Command Completion When working on the command line, you can use both the <Tab> key or the <?> key for command completion and assistance. For example, typing show e followed by entering the <Tab> key will complete the command as show expression. If, after typing <Tab> once and no completion is displayed, then hit <Tab> once more and the system
will offer you a set of possible completions.After the output is displayed, you are returned to the prompt with the portion of the command that was previously entered so that you may continue where you left off at. Using the question mark key offers a slightly different completion options.You may enter a question mark at any point on the command line and the system will provide you with a list of all possible completions that are recognized from that point forward. The following example illustrates this usage with the enable command. >enable enable acl enable alarm enable cr ... enable dns ... enable fipsSIMSource enable gslb ... enable ip enable nameServer enable ntp ... enable service enable snmp ... enable vpn ...
enable enable enable enable enable enable enable enable enable enable enable enable
acl6 authentication ... cs ... feature fipsSIMTarget interface lb ... ns ... server serviceGroup ssl ... vserver
Once the possible completions are printed, you are again returned to the command line with your previous entry still at the prompt for you to work with. Note that the question mark you type is not echoed at the CLI prompt. Any entries in the output that are followed by the ellipsis, such as the ssl command shown in the previous examples output, have further command completion levels beyond this point in the hierarchy. Utilizing Command Abbreviations and Shortcuts Another way to shorten command line input is to use command abbreviations. The CLI command abbreviation feature allows you to enter partial commands. To use this feature, you need only enter enough of the command's key words such that each of them is uniquely identifiable by the CLI. For example, to shorten the command add lb vserver, you may enter as little as ad lb vs and the CLI will correctly interpret your command. Note however, that for command group names you may not abbreviate them. In many cases you may leave them out entirely though. This is possible wherever command usage makes the group implicit, such as with the snmp and system group names when the entity type being acted upon is unique to the group. For example, there are no other entities of the community type outside of the snmp command group so issuing the add community command, rather than add snmp community, implicitly places this command in the snmp command group. This behavior is also illustrated with the system group and its entities. The user entity type exists in the system command group as well as the aaa command group therefore the user entity is not unique to the system group. So if you are issuing an action against a system user, such as an add command, you must specify the system group type so that the CLI will interpret your command as being directed at a system user, not an aaa user. The CLI will alert you in those cases where the group type is omitted incorrectly with an "ERROR: No such command" message. More examples of using these shortcuts are shown in Table 1.1 Table 2: Sample Command Abbreviations Abbreviated Command cl r sh ve se vpn p ff rm mx ad lb vs ad pol exp CLI Interpreted Command clear ns rnat show ns versio set vpn parameters force ns failover rm dns mxRec add lb vserver add policy expression
Abbreviated Command ae Navigating Command Output
CLI Interpreted Command
Often times, you will find that the screen output from the NSCLI will span multiple screens. When an output stream pauses at the first screens worth of output with --More-- displayed, you can navigate the remaining output with keystrokes. To cancel viewing the remaining output, press the <Q> key or use <Ctrl>+<C> to abort the command. To stream the remaining output without pauses, press the <C> key. To advance through the output one screen at a time press any other key.
Understanding Error Feedback When a CLI command is entered with invalid arguments, an error message is displayed, possibly preceded by an indication of the location of the error within the command line. After most errors, a short version of the command usage is also displayed. For example, typing the following command at the prompt: > add vserver vs 1 htto 10.101.4.99
Returns the following error messages: > add vserver vs 1 htto 10.101.4.99 ^^^^^ ERROR: Ambiguous command name The carats ("^^^^"), if present, indicate the location of the error in the command line. Note: The CLI will alert you if you try to configure a disabled or unlicensed feature. If you attempt to configure disabled features, your configurations will be applied, however they will have no effect on the runtime behavior of the system until the feature is enabled. If you attempt to configure an unlicensed feature, the system will return an error. Accessing the Command History The command line maintains a per user command entry history across sessions. This history maintains the last 100 user entered commands. Note that the history does not record sequentially duplicated commands. You may loop through the history on the command line by using the up and down arrow keys on your keyboard. You can recall the entire history log using the history command. A sample of the history log output is shown here. > history 1 logout 2 show snmp trap 3 logout 4 show snmp trap 5 logout 6 show snmp trap . . . . 96 add vserver 97 > add vserver vs 1 htto 10.101.4.99
98 add vserver vs 1 htto 10.101.4.99 99 history 100 logout 101 history Done You can also recall specific entries from within the history using the exclamation mark, or bang character (!). Use the ! in combination with either the desired history event number or an offset from the current event number to recall a specific history entry. Articles, Videos and more...
Advanced Command Line Usage

This section illustrates the remaining advanced features of the Command Line Interface. Understanding NSCLI Built-ins The Command Line Interface has several tools, or builtins, at your disposal for use within CLI sessions. To view these builtins use the builtins command. In addition to the previously mentioned history builtin tool, the use of other builtins can be used as discussed in the following sections. Compounding CLI Commands The nscli supports using the semicolon (;) character to enter multiple commands. To use this function, simply enter a semicolon between commands on the command line. The commands will be executed in order of entry. Using grep, more, and the Pipe Operator To help in managing and navigating command output the nscli supports the standard UNIX grep and more commands as well as the pipe operator ( | ). For the grep and more commands refer to the man pages in the nscli for complete usage details. The pipe operator is used in the nscli as it is on standard UNIX shells to redirect command output into another command, commonly with the grep and more commands. Applying Formatting Options In the nscli, most show commands have an implicit format argument. This argument formats the commands output in one of three ways. Normally the show server command outputs to the screen as shown here. > show server 2 servers: 1) Name: s1 State: ENABLED 2) Name: s2 State: ENABLED Done
IPAddress: IPAddress:
10.10.10.11 10.10.10.12
With the -format input option, the show server command prints in the command form that it would be input to the CLI, as shown here. > show server -format input 2 servers: add server s1 10.10.10.11 add server s2 10.10.10.12 Done The second formatting option, -format hierarchical, prints in a Cisco-like hierarchical format.
> show server -format hierarchical 2 servers: server s1 IPAddress: 10.10.10.11 server s2 IPAddress: 10.10.10.12 Done And the third type of formatting option, -format xhierarchical, prints the output in a Juniper-like hierarchical format > show server -format xhierarchical 2 servers: server s1 IPAddress 10.10.10.11; server s2 IPAddress 10.10.10.12; Done Creating and Using Aliases In order to allow you to customize your own command shortcuts, the system supports using aliases. To create a command alias you will need to use the alias command followed by the desired alias name and the command you wish to alias. For example, to create an alias for the show system users command you would enter the command as shown below. > alias users show system users To use the new alias, specify it as you would any other command. > users 1) Done 1 Configured system user: User name: nsroot
And to view the established aliases, use the alias command alone on the command line. > alias users (show system users)
To delete an alias, use the unalias command. > unalias users Customizing the CLI Prompt By default for all users, the CLI prompt is marked by the > character. You may customize the prompt to display differently using the set cli prompt command. The possible settings and parameters are listed in the following table followed by an example use of the command. Parameter %! %u %h, %m %t %T Prompt Displays Current history event number User name Configured hostname Current system time Current system time in 24 hour format
Parameter %d Example: > set cli prompt "%[T] %u@%h" Done [22:23] nsroot@localhost>
Prompt Displays Current date
Notice that you need to enclose the parameter in double quotes. You may chain multiple parameters together in addition to arbitrary strings and spaces to further customize the prompt. To do this, just include the desired string and parameters within a single double quoted string, as shown in the above example. If you would like to reset the prompt back to the system default, use the clear cli prompt command. To ensure that your prompt setting is retained across sessions, save your configuration once your desired prompt is set. This command prompt setting will apply only to the current system user. Using the @ Range Operator Many CLI commands allow for the creation and manipulation of a range of entities. Any command that has the @ symbol in its parameter listing is one of these commands. The presence of the range operator means that the argument it follows may be used with a range specification in order to act on a consecutive array of entities. To use these arguments with a range, you simply specify the argument normally and follow it with a bracketed range. For example, the command for creating a range of five load balancing vservers would use the following syntax: > add lb vserver httpvserve[1-5] http 192.168.1.1[1-5] 80 Notice that the IP address argument also specifies an address range. When adding a range of entities as shown here, dependant arguments must have a matching range specified as well. The command will return an error if the ranges differ. When you use an add command with the range option as shown here, the system will create 5 vservers with IP addresses ranging from 192.168.1.11 to 192.168.1.15. When alternately deleting a range of entities, the same methodology applies. To remove the range of vservers created in this example, you would issue the following command: > rm vserver httpvserve[1-5] Done Note: If a range of entities created with the range operation is somehow broken, such as via the manual removal of one or more of the entities, using the corresponding rm or set commands with a range operation against the range will not complete successfully. Executing Looped Commands The nscli allows for the use of UNIX shell style loops for repeated execution of commands. The example here uses this functionality to create ten http vservers with IP addresses 1.1.1.25 to 1.1.1.34. > @ n = 10 > @ x = 25 > while ($n) add vserver test$n http 1.1.1.$x 80 @ n-@ x++ end Done Done Done Done
Done Done Done Done Done Done The primary keywords available in the nscli for using this feature are while, end, and the @ operator. More details on these keywords are available in the respective man pages for each of them as well as their Command Reference descriptions in this reference. Articles, Videos and more...
Chapter
2
Introduction - Contextual CLI
Topics: How to use This Reference Command Conventions Command Line Overview
Welcome to the Command Reference Guide. This reference covers all aspects of using the Command Line Interface in the configuration and operation of the system. For information on accessing your system's Command Line Interface, please refer to the Installation chapter in the Installation and Configuration Guide before continuing on from this point. Articles, Videos and more...
50 | Citrix NetScaler 10 | Introduction - Contextual CLI
How to use This Reference

This command reference consists of three chapters: Chapter 1 Chapter 2 The Command Line Overview which explains how to use the Command Line Interface. The Command Line Overview which explains how to use the Contextual Command Line Interface (CCLI). Alphabetically ordered descriptions of all of the commands.
Chapter 3
If you are unfamiliar with using the system, you should start with the CLI usage chapter to familiarize yourself with the interface after reviewing the following section on document conventions. Otherwise, this document serves as the primary source of information on the commands available both in the NSCLI and CCLI and may be accessed at any arbitrary point as your needs dictate. Articles, Videos and more...
Command Conventions
These conventions are used to describe the commands in this guide. Convention command Alerts You To Command and argument names can be entered in any combination of upper and lower case characters. In this document command and argument names are sometimes displayed in upper and lower case. This is for readability and does not reflect the way in which the commands must be entered. This typeface represents a command argument. Text with this typeface represents information on a screen, as well as the names of directories, files, and commands. Keyboard key names appear within angle brackets. A plus sign appears between keys you must press simultaneously. Italic type emphasizes text or indicates new terms. Arguments that are contained within square brackets are optional. Arguments that are not contained within brackets are required. Angle Brackets (< >) Arguments within angle brackets are variable place holders. Replace these with values appropriate for your configuration. When arguments are separated by vertical bars, either argument can be specified.
command argument screen text
<key name>+<key name>
text in italics Square Brackets ( [ ] )
Vertical Bars ( | )
Citrix NetScaler 10 | Introduction - Contextual CLI | 51
Note: When entering the argument, neither the brackets nor the vertical bars are included. Articles, Videos and more...
Command Line Overview

This section discusses the usage of the Contextual Command Line Interface. The discussion is broken up in to two sections, basic and advanced CLI usage. The basic section covers all of the rudimentary aspects of the CLI which provides the information necessary for basic CCLI usage. The advanced usage section expands on the remaining features of CCLI, which allow you to further control and enhance your sessions, but are not required for day to day operation. Articles, Videos and more...
Basic Command Line Usage

This section discusses the essential instruction necessary for basic command line usage with the system. Start with this section if you are unfamiliar with the CLI. Understanding the Contextual CLI o use CCLI, execute the config command at the command prompt. This is the top-level context from where the user can access the other contexts. >config Done config> To configure system entities, you must enter a child context from the config context. To view all the child contexts, type ? at the command prompt. This command works at all contexts. config> aaa ... appfw ... audit ... authentication ... authorization ... cache ... cli ... cmp ... cr ... cs ... dns ... dos ... filter ... gslb ... lb ... network ... ns ... ntp ... policy ... pq ... responder ... rewrite ... router ... snmp ... sc ... ssl ... system ... tm ...
transform ... tunnel ... vpn ... location locationParameter locationFile server service serviceGroup vserver uiinternal config> To create an entity, you need to specify all the required arguments at the 'config' prompt. config> lb vserver vlb1 http This creates a load balancing vserver named vlb1. Note: The name need not always be the only key argument for an entity. For commands corresponding to SNMP traps, the 'trapclass' and 'trapdestination' are the key arguments for uniquely identifying the entity. Notice that the prompt changes to display the context and the system entity being accessed. Once you reach the context corresponding to a system entity, you can execute commands to view and modify the parameters of the entity. In the following example, the persistence on the vserver is set to SOURCEIP. config lb vserver vlb1> persistenceType SOURCEIP Done config lb vserver vlb1> sh lb vserver vlb1 HTTP 80 -range 1 IPAddress 10.102.29.52 persistenceType SOURCEIP persistenceBackup NONE lbMethod LEASTCONNECTION persistMask 255.255.255.255 pq OFF sc OFF m IP dataLength 0 dataOffset 0 sessionless DISABLED timeout 2 connfailover DISABLED cacheable NO soMethod NONE soPersistence DISABLED soPersistenceTimeOut 2 redirectPortRewrite DISABLED sendRespVsvrDown DISABLED Done When you type the name of an entity at the command prompt, the system transfers you to the entity specific-context if the entity exists. For example, when you type lb vserver vlb1, the prompt changes to config lb vserver vlb1. This is because the vserver vlb1 already exists. config> lb vserver vlb1 config lb vserver vlb1>
However, if the entity does not exist, an error message is displayed. This is illustrated in the following example. Here, the vserver vlb2 does not exist. config> lb vserver vlb2 ERROR: No such resource [vserver, vlb2] It is usually necessary to enter additional parameters to create a new entity: config> lb vserver vlb2 http 10.101.20.20 80 config lb vserver vlb2> Some commands which are not strictly part of the current context can be executed in context, and are implicitly applied to the entity. Here the show command is executed at the entity-specific context corresponding to the vserver, vlb1. config lb vserver vlb1> show lb vserver vlb1 HTTP 80 -range 1 IPAddress 10.102.29.52 persistenceType SOURCEIP persistenceBackup NONE lbMethod LEASTCONNECTION persistMask 255.255.255.255 pq OFF sc OFF m IP dataLength 0 dataOffset 0 sessionless DISABLED timeout 2 connfailover DISABLED cacheable NO soMethod NONE soPersistence DISABLED soPersistenceTimeOut 2 redirectPortRewrite DISABLED sendRespVsvrDown DISABLED ! Done To modify another entity, you must return to the config context and enter the context of the other entity. config lb vserver vlb1> persistenceType SRCIPDESTIP Done config lb vserver vlb1> exit Done config lb vserver vlb2> persistenceType SRCIPDESTIP Done To delete an entity or disable an attribute, use the no command. This is illustrated by the following examples. config> no lb vserver vlb1 Done Getting Help in the CLI The help command offers a quick way to get more information on commands. The command can return help on specific commands, groups of commands, or the entire set of nscli commands. By typing help alone on the command line, the system will print a brief general help message as shown here. 14:44 config> help NetScaler command-line interface Try :
'help <commandName>' 'help <groupName>' 'help -all' 'man <commandName>'
for for for for
full usage of a specific command brief usage of a group of commands brief usage of all CLI commands a complete command description
'?' will show possible completions in the current context The command groups are: basic audit cache cr dos HA ns pq rewrite sc tm utility Done aaa authentication cli cs filter lb ntp protocol router ssl transform vpn appfw authorization cmp dns gslb network policy responder snmp system tunnel
If you need help on using a specific command or command group, utilize the syntax shown above substituting that command or group name you need help for. By specifying the command name, the CLI feedback will provide you with a full listing of the command's syntax along with an expansion on those parameters with limited sets of options.If you enter a group name, the CLI will print a full list of the commands that belong to that group. The question mark <?> can also be used to get help in the CLI. By typing a question mark alone, the system will print out a listing of all the actions available from the top level command structure. Getting Help with Man Pages The command line interface has its own set of man pages similar to those traditionally found in UNIX and UNIX like operating systems. This system returns the same command reference information as is found in this guide. To use this help feature, issue the man command using the name of the command you wish to view information on as the argument. Once the first screen is displayed, you may scroll through the page either a screen at a time or line by line. To advance line by line, press the <Enter> key. To advance to the next screen use the space bar. When viewing commands with man, to exit the page before reaching the end of it, press the <Q> key. Using Command Completion When working on the command line, you can use both the <Tab> key or the <?> key for command completion and assistance. For example, typing show e followed by entering the <Tab> key will complete the command as show expression. If, after typing <Tab> once and no completion is displayed, then hit <Tab> once more and the system will offer you a set of possible completions.After the output is displayed, you are returned to the prompt with the portion of the command that was previously entered so that you may continue where you left off at. Using the question mark key offers a slightly different completion options.You may enter a question mark at any point on the command line and the system will provide you with a list of all possible completions that are recognized from that point forward. The following example illustrates this usage with the enable command. enable enable enable enable enable enable enable enable enable enable <?> acl alarm cr ... dns ... fipsSIMSource gslb ... ip nameServer ntp ...
enable enable enable enable enable enable enable enable enable
acl6 authentication ... cs ... feature fipsSIMTarget interface lb ... ns ... server
enable service enable snmp ... enable vpn ...
enable serviceGroup enable ssl ... enable vserver
Once the possible completions are printed, you are again returned to the command line with your previous entry still at the prompt for you to work with. Note that the question mark you type is not echoed at the CLI prompt. Any entries in the output that are followed by the ellipsis, such as the ssl command shown in the previous examples output, have further command completion levels beyond this point in the hierarchy. Utilizing Command Abbreviations and Shortcuts Another way to shorten command line input is to use command abbreviations. The CLI command abbreviation feature allows you to enter partial commands. To use this feature, you need only enter enough of the command's key words such that each of them is uniquely identifiable by the CLI. For example, to shorten the command add lb vserver, you may enter as little as ad lb vs and the CLI will correctly interpret your command. Note however, that for command group names you may not abbreviate them. In many cases you may leave them out entirely though. This is possible wherever command usage makes the group implicit, such as with the snmp and system group names when the entity type being acted upon is unique to the group. For example, there are no other entities of the community type outside of the snmp command group so issuing the add community command, rather than add snmp community, implicitly places this command in the snmp command group. This behavior is also illustrated with the system group and its entities. The user entity type exists in the system command group as well as the aaa command group therefore the user entity is not unique to the system group. So if you are issuing an action against a system user, such as an add command, you must specify the system group type so that the CLI will interpret your command as being directed at a system user, not an aaa user. The CLI will alert you in those cases where the group type is omitted incorrectly with an "ERROR: No such command" message. Table 3: Sample Command Abbreviations Abbreviated Command cl r sh ve se vpn p ff rm mx ad lb vs ad pol exp ae Navigating Command Output Often times, you will find that the screen output from the NSCLI will span multiple screens. When an output stream pauses at the first screens worth of output with --More-- displayed, you can navigate the remaining output with keystrokes. To cancel viewing the remaining output, press the <Q> key or use <Ctrl>+<C> to abort the command. To stream the remaining output without pauses, press the <C> key. To advance through the output one screen at a time press any other key. Understanding Error Feedback When a CLI command is entered with invalid arguments, an error message is displayed, possibly preceded by an indication of the location of the error within the command line. After most errors, a short version of the command usage is also displayed. For example, typing the following command at the prompt: CLI Interpreted Command clear ns rnat show ns version set vpn parameters force ns failover rm dns mxRec add lb vserver add policy expression
>
add vserver vs 1 htto 10.101.4.99
Returns the following error messages: > add vserver vs 1 htto 10.101.4.99 ^^^^^ ERROR: Ambiguous command name The carats ("^^^^"), if present, indicate the location of the error in the command line. Note: The CLI will alert you if you try to configure a disabled or unlicensed feature. If you attempt to configure disabled features, your configurations will be applied, however they will have no effect on the runtime behavior of the system until the feature is enabled. If you attempt to configure an unlicensed feature, the system will return an error. Accessing the Command History The command line maintains a per user command entry history across sessions. This history maintains the last 100 user entered commands. Note that the history does not record sequentially duplicated commands. You may loop through the history on the command line by using the up and down arrow keys on your keyboard. You can recall the entire history log using the history command. A sample of the history log output is shown here. > history 1 logout 2 show snmp trap 3 logout 4 show snmp trap 5 logout 6 show snmp trap . . . . 96 add vserver 97 > add vserver vs 1 htto 10.101.4.99 98 add vserver vs 1 htto 10.101.4.99 99 history 100 logout 101 history Done You can also recall specific entries from within the history using the exclamation mark, or bang character (!). Use the ! in combination with either the desired history event number or an offset from the current event number to recall a specific history entry. Articles, Videos and more...
Advanced Command Line Usage

This section illustrates the remaining advanced features of the Command Line Interface. Compounding CLI Commands The nscli supports using the semicolon (;) character to enter multiple commands. To use this function, simply enter a semicolon between commands on the command line. The commands will be executed in order of entry. This is illustrated by the following example. > add service SVC10 10.102.11.11 HTTP 80 ; add service SVC20 10.102.11.12 HTTP 80
Using grep, more, and the pipe Operator To help in managing and navigating command output the CLI supports the standard UNIX grep and more commands as well as the pipe operator ( | ). For the grep and more commands, refer to the man pages for complete usage details. The pipe operator is used as it is on standard UNIX shells to redirect command output into another command, commonly with the grep and more commands. Applying Formatting Options In the nscli, most show commands have an implicit format argument. This argument formats the commands output in one of three ways. Normally the show server command outputs to the screen as shown here. > show server 2 servers: 1) Name: s1 State: ENABLED 2) Name: s2 State: ENABLED Done
IPAddress: IPAddress:
10.10.10.11 10.10.10.12
In addition, CCLI supports the following output formats: INPUT - When this format is specified, the output is displayed in the contextual format. This is illustrated as follows. config> sh lb vserver -format INPUT lb vserver vlb1 HTTP 80 IPAddress 10.102.29.52 lb vserver vdns DNS 53 IPAddress 10.102.29.53 persistenceType NONE OLD - When this format is specified, the output is displayed in the Classic CLI format. This is illustrated as follows. config> sh lb vserver -format OLD add lb vserver vlb1 HTTP 10.102.29.52 80 add lb vserver vdns DNS 10.102.29.53 53 -persistenceType NONE TEXT - When this format is specified, the output is displayed with all the details of the entity. This is illustrated as follows. config> sh lb vserver -format TEXT 1) Name: vlb1 Value: IPAddress: 10.102.29.52 Port: 80 Range: 1 ServiceType: HTTP Type: ADDRESS State: UP EffectiveState: UP Status: 3 CacheType: SERVER Redirect: Precedence: RedirectURL: Authentication: OFF HomePage: "" DnsVserverName: "" Domain: a.com Rule: "" PolicyName: "" ServiceName: "" Weight: 0 CacheVserver: "" BackupVServer: "" Priority: 0 CltTimeout: 180 SoMethod: NONE SoPersistence: DISABLED SoPersistenceTimeOut: 2 SoThreshold: 0 SoDynamicThreshold: 0 LbMethod: LEASTCONNECTION HashLength: 0 DataOffset: 0 DataLength: 0 Netmask: 0.0.0.0
Rule: "" GroupName: dqfw M: IP PersistenceType: COOKIEINSERT CookieDomain: a.com PersistMask: 255.255.255.255 PersistenceBackup: NONE Timeout: 2 Cacheable: NO Pq: OFF Sc: OFF Sessionless: DISABLED Map: OFF Connfailover: DISABLED RedirectPortRewrite: DISABLED SendRespVsvrDown: DISABLED 2) Name: vdns Value: IPAddress: 10.102.29.53 Port: 53 Range: 1 ServiceType: DNS Type: ADDRESS State: UP EffectiveState: UP Status: 3 CacheType: SERVER Redirect: Precedence: RedirectURL: Authentication: OFF HomePage: "" DnsVserverName: "" Domain: "" Rule: "" PolicyName: "" ServiceName: "" Weight: 0 CacheVserver: "" BackupVServer: "" Priority: 0 CltTimeout: 120 SoMethod: NONE SoPersistence: DISABLED SoPersistenceTimeOut: 2 SoThreshold: 0 SoDynamicThreshold: 0 LbMethod: LEASTCONNECTION HashLength: 0 DataOffset: 0 DataLength: 0 Netmask: 0.0.0.0 Rule: "" GroupName: "" M: IP PersistenceType: NONE CookieDomain: "" PersistMask: 255.255.255.255 PersistenceBackup: NONE Timeout: 2 Cacheable: NO Pq: OFF Sc: OFF Sessionless: DISABLED Map: OFF Connfailover: DISABLED RedirectPortRewrite: DISABLED SendRespVsvrDown: DISABLED DECORATED - When this format is specified, the output is displayed in the contextual format with braces and semicolons. This is illustrated as follows. config> sh lb vserver -format DECORATED lb vserver vlb1 HTTP 80 IPAddress 10.102.29.52 lb vserver vdns DNS 53 IPAddress 10.102.29.53 persistenceType NONE
Customizing the CLI Prompt By default for all users, the CLI prompt is marked by the > character. You may customize the prompt to display differently using the set cli prompt command. The possible settings and parameters are listed in the following table followed by an example use of the command. Table 4: Prompt Settings Parameter %! %u %h, %m %t %T Prompt Displays Current history event number User name Configured hostname Current system time Current system time in 24 hour format
Parameter %d Example: > set cli prompt "%[T] %u@%h" Done [22:23] nsroot@localhost>
Prompt Displays Current date
Notice that you need to enclose the parameter in double quotes. You may chain multiple parameters together in addition to arbitrary strings and spaces to further customize the prompt. To do this, just include the desired string and parameters within a single double quoted string, as shown in the above example. If you would like to reset the prompt back to the system default, use the clear cli prompt command. To ensure that your prompt setting is retained across sessions, save your configuration once your desired prompt is set. This command prompt setting will apply only to the current system user. Using the @ Range Operator Many CLI commands allow for the creation and manipulation of a range of entities. Any command that has the @ symbol in its parameter listing is one of these commands. The presence of the range operator means that the argument it follows may be used with a range specification in order to act on a consecutive array of entities. To use these arguments with a range, you simply specify the argument normally and follow it with a bracketed range. For example, the command for creating a range of five load balancing vservers would use the following syntax: config> vserver vserver vserver vserver vserver Done lb vserver httpvserve[1-5] http 192.168.1.1[1-5] 80 "httpvserve1" added "httpvserve2" added "httpvserve3" added "httpvserve4" added "httpvserve5" added
Notice that the IP address argument also specifies an address range. When adding a range of entities as shown here, dependant arguments must have a matching range specified as well. The command will return an error if the ranges differ. When you use an add command with the range option as shown here, the system will create 5 vservers with IP addresses ranging from 192.168.1.11 to 192.168.1.15. When alternately deleting a range of entities, the same methodology applies. To remove the range of vservers created in this example, you would issue the following command: config> vserver vserver vserver vserver vserver Done rm vserver httpvserve[1-5] "httpvserve1" removed "httpvserve2" removed "httpvserve3" removed "httpvserve4" removed "httpvserve5" removed Note: If a range of entities created with the range operation is somehow broken, such as via the manual removal of one or more of the entities, using the corresponding rm or set commands with a range operation against the range will not complete successfully. Articles, Videos and more...
Chapter
3
AAA Commands
Topics: stat aaa add aaa user rm aaa user set aaa user bind aaa user unbind aaa user show aaa user add aaa group rm aaa group bind aaa group unbind aaa group show aaa group add aaa preauthenticationaction rm aaa preauthenticationaction set aaa preauthenticationaction unset aaa preauthenticationaction show aaa preauthenticationaction add aaa preauthenticationpolicy rm aaa preauthenticationpolicy set aaa preauthenticationpolicy show aaa preauthenticationpolicy show aaa stats show aaa session kill aaa session set aaa radiusParams unset aaa radiusParams show aaa radiusParams set aaa ldapParams unset aaa ldapParams show aaa ldapParams set aaa tacacsParams unset aaa tacacsParams show aaa tacacsParams
62 | Citrix NetScaler 10 | AAA Commands
set aaa certParams unset aaa certParams show aaa certParams set aaa parameter unset aaa parameter show aaa parameter set aaa preauthenticationparameter unset aaa preauthenticationparameter show aaa preauthenticationparameter bind aaa global unbind aaa global show aaa global
Citrix NetScaler 10 | AAA Commands | 63
stat aaa
Synopsis stat aaa [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display aaa statistics Arguments Authentication successes (authsucc) Count of authentication successes. Authentication failures (authfails) Count of authentication failures. HTTP authorization successes (atzhtps) Count of HTTP connections that succeeded authorization. HTTP authorization failures (atzhtpf) Count of HTTP connections that failed authorization. Non HTTP authorization successes (atznonhtps) Count of non HTTP connections that succeeded authorization. Non HTTP authorization failures (atznonhtpf) Count of non HTTP connections that failed authorization. Current ICAOnly sessions (totcuricasess) Count of current ICA only sessions. Current AAA sessions (totcursess) Count of current AAA sessions. AAA sessions (totsess) Count of all AAA sessions. Timed out AAA sessions (totsessto) Count of AAA sessions that have timed out. Example
Related Commands
add aaa user

Synopsis add aaa user <userName> {-password } Description Add an AAA user. Arguments userName
The name of the user. password Enter this keyword to create or change the user's password. The entered password is not displayed. If no password is given for a new user then the user will be authenticated externally. Example add aaa user johndoe -password abcd add aaa user johndoe -password The above example adds user johndoe with password abcd for first case, password supplied on prompt for second case
Related Commands rm aaa user set aaa user show aaa user
rm aaa user
Synopsis rm aaa user <userName> Description Remove the AAA user. Arguments userName The name of the AAA user. Example
Related Commands add aaa user set aaa user show aaa user
set aaa user

Synopsis set aaa user <userName> Description Modify the parameters for the existing AAA user. Arguments userName The name of the user.
password Enter this keyword to create or change the user's password. The entered password is not displayed. If no password is given for a new user then the user will be authenticated externally. Example set aaa user johndoe password abcd The above command sets the password for johndoe to abcd
Related Commands add aaa user rm aaa user show aaa user
bind aaa user

Synopsis bind aaa user <userName> [-policy <string> [-priority <positive_integer>]] [-intranetApplication <string>] [-urlName <string>] [-intranetIP <ip_addr> [<netmask>]] Description Bind the resources (policy/intranetip/intranetapplication/url) to a user. Arguments userName The user name. policy the policy to be bound to aaa user. intranetApplication The intranet vpn application. urlName The intranet url intranetIP The IP address to be bound to this user and used to access the Intranet Example To bind intranetip to the user joe: bind aaa user joe -intranetip 10.102.1.123
Related Commands unbind aaa user
unbind aaa user

Synopsis unbind aaa user <userName> [-policy <string>] [-intranetApplication <string>] [-urlName <string>] [-intranetIP <ip_addr> [<netmask>]]
Description Unbind the resource(policy/intranetip/intranetapplication/url) from an AAA user Arguments userName The user name. policy The policy to be unbound to an aaa user. intranetApplication The intranet vpn application. urlName The intranet url intranetIP The Intranet IP to be unbound Example unbind AAA user joe -intranetip 10.102.1.123
Related Commands bind aaa user
show aaa user

Synopsis show aaa user [<userName>] [-loggedIn] Description Display the AAA user detail. Arguments userName The user name. loggedIn The loggedin flag. When this flag is turned on, the system displays the names of all logged-in users. If a user name is included, the system displays whether the user is logged in or not. summary fullValues format level groupName The group name policy The policy Name. priority
The priority of the policy. intranetApplication The intranet vpn application. urlName The intranet url. actType intranetIP The Intranet IP bound to the user netmask The netmask for the Intranet IP policySubType stateflag password Enter this keyword to create or change the user's password. The entered password is not displayed. If no password is given for a new user then the user will be authenticated externally. count Example Example > show aaa user joe UserName: joe IntranetIP: 10.102.1.123 Bound to groups: GroupName: engg Done >
Related Commands add aaa user rm aaa user set aaa user
add aaa group

Synopsis add aaa group <groupName> Description Add an AAA group. To associate AAA users with an AAA group, use the command "bind AAA group ... username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... -policy ...". You can also bind ranges of Intranet IP addresses to an AAA group. For example, the administrator may want to assign pools of Intranet IP addresses to groups or departments. Arguments groupName The name of the group. Example add aaa group group_ad
Related Commands rm aaa group show aaa group
rm aaa group
Synopsis rm aaa group <groupName> Description Remove an AAA group. To associate AAA users with an AAA group, use the command "bind AAA group ... username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... -policy ...". You can also bind ranges of Intranet IP addresses to an AAA group. For example, the administrator may want to assign pools of Intranet IP addresses to groups or departments. Arguments groupName The name of the group . Note: Any user sessions belonging to the group are removed. The user must log in again. Example
Related Commands add aaa group show aaa group
bind aaa group

Synopsis bind aaa group <groupName> [-userName <string>] [-policy <string> [-priority <positive_integer>]] [intranetApplication <string>] [-urlName <string>] [-intranetIP <ip_addr> <netmask>] Description Bind the resource(User/Intranet IP /Policy/Intranet Application) to a group. To associate AAA users with an AAA group, use the command "bind AAA group ... -username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... -policy ...". You can also bind ranges of Intranet IP addresses to an AAA group. For example, the administrator may want to assign pools of Intranet IP addresses to groups or departments. Arguments groupName The group name. userName The user that the group is bound to. If the user belongs to more than one group, the group expressions are evaluated at authorization to determine the appropriate action. policy
The policy to be bound to an AAA group. intranetApplication The intranet vpn application. urlName The intranet url. intranetIP The ip-block or IP address to be bound with this group. This is the block or address that will be used when members of this group access Intranet resources. Example To bind an Intranet IP to the group engg: bind aaa group engg -intranetip 10.102.10.0 255.255.255.0
Related Commands unbind aaa group
unbind aaa group

Synopsis unbind aaa group <groupName> [-userName <string> ...] [-policy <string>] [-intranetApplication <string>] [urlName <string>] [-intranetIP <ip_addr> <netmask>] Description Unbind the resource (User/Intranet IP/Policy/Intranet Application) from a group. To associate AAA users with an AAA group, use the command "bind AAA group ... -username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... -policy ...". You can also bind ranges of Intranet IP addresses to an AAA group. For example, the administrator may want to assign pools of Intranet IP addresses to groups or departments. Arguments groupName The group name. userName The user to be unbound from the group. policy The policy to be unbound from the AAA group, intranetApplication The intranet vpn application. urlName The intranet url. intranetIP The Intranet IP to be unbound from the group Example unbind aaa group engg -intranetip 10.102.10.0 255.255.255.0
Related Commands bind aaa group
show aaa group

Synopsis show aaa group [<groupName>] [-loggedIn] Description Display details of the AAA group. To associate AAA users with an AAA group, use the command "bind AAA group ... -username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... -policy ...". You can also bind ranges of Intranet IP addresses to an AAA group. For example, the administrator may want to assign pools of Intranet IP addresses to groups or departments. Arguments groupName The group name. loggedIn The loggedin flag. When this flag is turned on, the system displays the names of the users in a group if at least one user in the group is logged in. When used with a group name, the system lists the users in the group who are logged in. summary fullValues format level userName The user name. policy The policy name. priority The priority of the policy. intranetApplication The intranet vpn application. urlName The intranet url actType intranetIP The Intranet IP(s) bound to the group netmask The netmask for the Intranet IP policySubType stateflag count
Example > show aaa group engg GroupName: engg Bound AAA users: UserName: joe UserName: jane Intranetip IP: 10.102.10.0 Netmask: 255.255.255.0 Done > Related Commands add aaa group rm aaa group
add aaa preauthenticationaction

Synopsis add aaa preauthenticationaction <name> [<preauthenticationaction>] [-killProcess <string>] [-deletefiles <string>] Description Add actions for end point analysis (EPA) clients before authentication. Arguments name The name of the Preauthentication action. preauthenticationaction Deny or allow login after end point analysis results. Possible values: ALLOW, DENY killProcess Processes to be killed by the EPA tool. deletefiles Files to be deleted by EPA tool. Example
Related Commands rm aaa preauthenticationaction set aaa preauthenticationaction unset aaa preauthenticationaction show aaa preauthenticationaction
rm aaa preauthenticationaction
Synopsis rm aaa preauthenticationaction <name> Description Remove a previously created Pre-authentication action. Note that an action cannot be removed as long as it is configured in a policy. Arguments name
The name of the action to be removed. Example
Related Commands add aaa preauthenticationaction set aaa preauthenticationaction unset aaa preauthenticationaction show aaa preauthenticationaction
set aaa preauthenticationaction

Synopsis set aaa preauthenticationaction <name> [<preauthenticationaction>] [-killProcess <string>] [-deletefiles <string>] Description Change properties of a Pre-authentication action. Arguments name The name of the Preauthentication action. preauthenticationaction Deny or allow login after end point analysis results. Possible values: ALLOW, DENY killProcess Processes to be killed by EPA tool. deletefiles Files to be deleted by EPA tool. Example
Related Commands add aaa preauthenticationaction rm aaa preauthenticationaction unset aaa preauthenticationaction show aaa preauthenticationaction
unset aaa preauthenticationaction

Synopsis unset aaa preauthenticationaction <name> [-killProcess] [-deletefiles] Description Use this command to remove aaa preauthenticationaction settings.Refer to the set aaa preauthenticationaction command for meanings of the arguments.
Arguments Example
Related Commands add aaa preauthenticationaction rm aaa preauthenticationaction set aaa preauthenticationaction show aaa preauthenticationaction
show aaa preauthenticationaction

Synopsis show aaa preauthenticationaction [<name>] Description Display details of the configured Pre-authentication action(s). Arguments name The name of the RADIUS action. summary fullValues format level preauthenticationaction Deny or allow login after end point analysis results. killProcess Processes to be killed by the EPA tool. deletefiles Files to be deleted by EPA tool. stateflag count Example
Related Commands add aaa preauthenticationaction rm aaa preauthenticationaction set aaa preauthenticationaction unset aaa preauthenticationaction
add aaa preauthenticationpolicy

Synopsis add aaa preauthenticationpolicy <name> <rule> [<reqAction>] Description Add a Radius authentication policy. The policy defines expressions to be evaluated by the EPA tool. Arguments name The name to assign to the new Pre-authentication policy. rule The name of the rule or expression that the policy will use. reqAction The name of the RADIUS action the policy will use. Example
Related Commands rm aaa preauthenticationpolicy set aaa preauthenticationpolicy show aaa preauthenticationpolicy
rm aaa preauthenticationpolicy
Synopsis rm aaa preauthenticationpolicy <name> Description Remove a Pre-authentication policy. Arguments name The name of the Pre-authentication policy to remove. Example
Related Commands add aaa preauthenticationpolicy set aaa preauthenticationpolicy show aaa preauthenticationpolicy
set aaa preauthenticationpolicy

Synopsis set aaa preauthenticationpolicy <name> [-rule <expression>] [-reqAction <string>]
Description Change the properties of a Pre-authentication policy. Arguments name The name of the policy. rule The new rule to be associated with the policy. reqAction The new Pre-authentication action to be associated with the policy. Example
Related Commands add aaa preauthenticationpolicy rm aaa preauthenticationpolicy show aaa preauthenticationpolicy
show aaa preauthenticationpolicy

Synopsis show aaa preauthenticationpolicy [<name>] Description Display configured Pre-authentication policies. Arguments name The name of the policy. If this option is not provided, all of the configured RADIUS policies will be displayed. summary fullValues format level rule The new rule associated with the policy. reqAction The Pre-authentication action associated with the policy. hits No of hits. boundTo The entity name to which policy is bound activePolicy priority
bindPolicyType policyType count stateflag Example
Related Commands add aaa preauthenticationpolicy rm aaa preauthenticationpolicy set aaa preauthenticationpolicy
show aaa stats

Synopsis show aaa stats - alias for 'stat aaa' Description show aaa stats is an alias for stat aaa Arguments Example
Related Commands stat aaa
show aaa session

Synopsis show aaa session [-userName <string>] [-groupName <string>] [-intranetIP <ip_addr|*> [<netmask>]] Description Display the connections initated by the user Arguments userName The user name. groupName The group name. intranetIP Intranet IP address. publicIP Client's public IP address
publicPort Client's public port IPAddress NetScaler's IP address port NetScaler's port privateIP Client's private/mapped IP address privatePort Client's private/mapped port destIP Destination IP address destPort Destination port intranetIP Specifies the Intranet IP peId Core id of the session owner stateflag count Example > show aaa connection ClintIp (ClientPort) -> ServerIp(ServerPort) ---------------------------------------------------- User Name: Joe 10.102.0.39 (2318 ) -> 10.102.4.245 (443 ) 10.102.0.39 (2320 ) -> 10.102.4.245 (443 ) 10.102.0.39 (2340 ) -> 10.102.4.245 (443 ) Done >
Related Commands kill aaa session
kill aaa session

Synopsis kill aaa session [-userName <string>] [-groupName <string>] [-intranetIP <ip_addr|*> [<netmask>]] [-all] Description Kill the user sessions Arguments userName The user name. The system will terminate the session initiated by the named user. groupName The group name. The system will terminate the sessions of all the users within the named group. intranetIP The Intranet IP address. The system will terminate all sessions using the named intranet IP address
all Terminate the sessions of all users who are currently logged in. Example kill aaa session -user joe Related Commands show aaa session
set aaa radiusParams

Synopsis set aaa radiusParams [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] {radKey } [-radNASip ( ENABLED | DISABLED )] [-radNASid <string>] [-radVendorID <positive_integer>] [radAttributeType <positive_integer>] [-radGroupsPrefix <string>] [-radGroupSeparator <string>] [-passEncoding <passEncoding>] [-ipVendorID <positive_integer>] [-ipAttributeType <positive_integer>] [-accounting ( ON | OFF )] [-pwdVendorID <positive_integer>] [-pwdAttributeType <positive_integer>] Description Modify the global variables for the RADIUS server. It will be used globally in SSL-VPN across all Vservers unless you create a vserver-specific configuration using authentication policies. Arguments serverIP The IP address of the RADIUS server. serverPort The port number on which the RADIUS server is running. Default value: 1812 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the RADIUS server. Default value: 3 Minimum value: 1 radKey The key shared between the client and the server. This information is required for the system to communicate with the RADIUS server. radNASip The option to send the NetScaler's IP address (NSIP) to the server as the "nasip" (Network Access Server IP) part of the Radius protocol. Possible values: ENABLED, DISABLED radNASid The nasid (Network Access Server ID). If configured, this string will be sent to the RADIUS server as the "nasid" part of the Radius protocol. radVendorID The Vendor ID for Radius group extraction. Minimum value: 1 radAttributeType The Attribute type for Radius group extraction. Minimum value: 1 radGroupsPrefix The groups prefix string that precedes the group names within a RADIUS attribute for RADIUS group extraction. radGroupSeparator
The group separator string that delimits group names within a RADIUS attribute for RADIUS group extraction. passEncoding The option to encode the password in the Radius packets traveling from the NetScaler to the Radius server. Possible values: pap, chap, mschapv1, mschapv2 Default value: AAA_PAP ipVendorID The vendor ID of the attribute in the RADIUS response. The vendor ID denotes the intranet IP. The value of 0 denotes that the attribute is not vendor-encoded. ipAttributeType The attribute type of the remote IP address attribute in a RADIUS response. Minimum value: 1 accounting The state of the RADIUS server to receive accounting messages. Possible values: ON, OFF pwdVendorID Vendor ID of the attribute in the RADIUS response which will be used to extract the user Password. Minimum value: 1 Example To configure the default RADIUS parameters: set aaa radiusparams -serverip 192.30.1.2 -radkey sslvpn
Related Commands add authentication radiusaction set aaa ldapparams set aaa parameter unset aaa radiusParams show aaa radiusParams
unset aaa radiusParams

Synopsis unset aaa radiusParams [-serverIP] [-serverPort] [-authTimeout] [-radNASip] [-radNASid] [-radVendorID] [radAttributeType] [-radGroupsPrefix] [-radGroupSeparator] [-passEncoding] [-ipVendorID] [-ipAttributeType] [accounting] [-pwdVendorID] [-pwdAttributeType] Description Use this command to remove aaa radiusParams settings.Refer to the set aaa radiusParams command for meanings of the arguments. Arguments Example
Related Commands set aaa radiusParams show aaa radiusParams
show aaa radiusParams

Synopsis show aaa radiusParams Description Display the configured RADIUS parameters. Arguments format level serverIP The IP address of the RADIUS server. serverPort The port number on which the RADIUS server is running. radKey The key shared between the client and the server. groupAuthName To associate AAA users with an AAA group, use the command "bind AAA group ... -username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... policy ..." authTimeout The maximum number of seconds the system will wait for a response from the RADIUS server. radNASip The option to send the NetScaler's IP address (NSIP) as the "nasip" (Network Access Server IP) part of the Radius protocol to the server. radNASid The nasid (Network Access Server ID). If configured, this string will be sent to the RADIUS server as the "nasid" as part of the Radius protocol. IPAddress IP Address. radVendorID The Vendor ID for Radius group extraction. radAttributeType The Attribute type for Radius group extraction. radGroupsPrefix The groups prefix string that precedes the group names within a RADIUS attribute for RADIUS group extraction. radGroupSeparator The group separator string that delimits group names within a RADIUS attribute for RADIUS group extraction. passEncoding The option to encode the password in the Radius packets traveling from the NetScaler to the Radius server. ipVendorID
The vendor ID of the attribute in the RADIUS response. The vendor ID denotes the intranet IP. The value of 0 denotes that the attribute is not vendor-encoded. ipAttributeType The attribute type of the remote IP address attribute in a RADIUS response. accounting The state of the Radius server that will receive accounting messages. pwdVendorID Vendor ID of the attribute in the RADIUS response which will be used to extract the user Password. pwdAttributeType Attribute type of the vendor specific Password-Attribute in a RADIUS response. Example > show aaa radiusparams Configured RADIUS parameters Server IP: 127.0.0.2 Port: 1812 key: secret Timeout: 10 Done > Related Commands set aaa radiusParams unset aaa radiusParams
set aaa ldapParams

Synopsis set aaa ldapParams [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] [ldapBase <string>] [-ldapBindDn <string>] {-ldapBindDnPassword } [-ldapLoginName <string>] [-searchFilter <string>] [-groupAttrName <string>] [-subAttributeName <string>] [-secType <secType>] [-svrType ( AD | NDS )] [-ssoNameAttribute <string>] [-passwdChange ( ENABLED | DISABLED )] [-nestedGroupExtraction ( ON | OFF )] [-maxNestingLevel <positive_integer>] [-groupNameIdentifier <string>] [-groupSearchAttribute <string> [groupSearchSubAttribute <string>]] [-groupSearchFilter <string>] Description Set the global variables for the LDAP server. It is used globally in SSL-VPN across all Vservers unless you create a vserver-specific configuration using authentication policies. Arguments serverIP The IP address of the LDAP server. The default value is localhost. serverPort The port number on which the LDAP server is running. Default value: 389 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the LDAP server. Default value: 3 Minimum value: 1 ldapBase The base or node where the ldapsearch should start. If the LDAP server is running locally, the default value of base is dc=netscaler, dc=com. ldapBindDn The full distinguished name that is used to bind to the LDAP server. ldapBindDnPassword The password used to bind to the LDAP server.
ldapLoginName The name attribute used by the system to query the external LDAP server or an Active Directory. searchFilter The String to be combined with the default LDAP user search string to form the value. For example, vpnallowed=true with ldaploginame "samaccount" and user-supplied username "bob" would yield the LDAP search string "(&(vpnallowed=true)(samaccount=bob)". groupAttrName The attribute name for group extraction from the LDAP server subAttributeName The Sub-Attribute name for group extraction from LDAP server secType The type of communication between the system and the LDAP server. The values are: PLAINTEXT: No encryption required. TLS: To use the TLS protocol to communicate. SSL: To use the SSL Protocol to communicate. Possible values: PLAINTEXT, TLS, SSL Default value: AAA_LDAP_PLAINTEXT svrType The type of LDAP server. Possible values: AD, NDS Default value: AAA_LDAP_SERVER_TYPE_DEFAULT ssoNameAttribute The attribute used by the system to query the external LDAP server (or an Active Directory) for an alternate username to be used in Single Sign-On. passwdChange Enabling this option does not block password change request.Disabling would block password change request. Possible values: ENABLED, DISABLED Default value: DISABLED nestedGroupExtraction Setting this option to ON enables the nested group extraction feature where the system queries the external LDAP server to determine if a group belongs to another group Possible values: ON, OFF Default value: OFF Example To configure authentication in the LDAP server running at 192.40.1.2: set aaa ldapparams -serverip 192.40.1.2 -ldapbase "dc=netscaler,dc=com" -ldapBindDN "cn=Manager,dc=netscaler,dc=com" -ldapBindDnPassword secret -ldaploginname uid Related Commands add authentication ldapaction set aaa radiusparams set aaa parameter unset aaa ldapParams show aaa ldapParams
unset aaa ldapParams

Synopsis unset aaa ldapParams [-serverIP] [-serverPort] [-authTimeout] [-ldapBase] [-ldapBindDn] [-ldapBindDnPassword] [ldapLoginName] [-searchFilter] [-groupAttrName] [-subAttributeName] [-secType] [-svrType] [-ssoNameAttribute]
[-passwdChange] [-nestedGroupExtraction] [-maxNestingLevel] [-groupNameIdentifier] [-groupSearchAttribute] [groupSearchSubAttribute] [-groupSearchFilter] Description Use this command to remove aaa ldapParams settings.Refer to the set aaa ldapParams command for meanings of the arguments. Arguments Example
Related Commands set aaa ldapParams show aaa ldapParams
show aaa ldapParams

Synopsis show aaa ldapParams Description Display the configured LDAP parameters. Arguments format level serverIP The IP address of the LDAP server. serverPort The port number on which the LDAP server is running. authTimeout The maximum number of seconds the system will wait for a response from the LDAP server. ldapBindDn The full distinguished name used to bind to the LDAP server. ldapLoginName The name attribute used by the system to query the external LDAP server, or an Active Directory. ldapBase The base or node where the ldapsearch should start. If the LDAP server is running locally, the default value of base is dc=netscaler, dc=com. secType The communication type between the system and the LDAP server. svrType LDAP server. ssoNameAttribute The attribute used by the system to query the external LDAP server, or an Active Directory, for an alternate username to be used in Single Sign-On.
searchFilter The String to be combined with the default LDAP user search string to form the value. For example, vpnallowed=true with ldaploginame "samaccount" and the user-supplied username "bob" would yield the LDAP search string "(&(vpnallowed=true)(samaccount=bob)". groupAttrName The Attribute name for group extraction from the LDAP server. subAttributeName The Sub-Attribute name for group extraction from LDAP server groupAuthName To associate AAA users with an AAA group, use the command "bind AAA group ... -username ...". You can bind different policies to each AAA group. Use the command "bind AAA group ... policy ..." passwdChange Enabling this option does not block password change request.Disabling would block password change request. nestedGroupExtraction Setting this option to ON enables the nested group extraction feature where the system queries the external LDAP server to determine if a group belongs to another group maxNestingLevel groupNameIdentifier groupSearchAttribute groupSearchSubAttribute groupSearchFilter Example > show aaa ldapparams Configured LDAP parameters Server IP: 127.0.0.1 Port: 389 Timeout: 1 BindDn: cn=Manager,dc=florazel,dc=com login: uid Base: dc=florazel,dc=com Secure Type: PLAINTEXT Done > Related Commands set aaa ldapParams unset aaa ldapParams
set aaa tacacsParams

Synopsis set aaa tacacsParams [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] {tacacsSecret } [-authorization ( ON | OFF )] [-accounting ( ON | OFF )] Description Set the global variables for the TACACS+ server. It is used globally in SSL-VPN across all Vservers unless a vserver-specific configuration is done using authentication policies. Arguments serverIP The IP address of the TACACS+ server.
serverPort The port on which the TACACS+ server is running. Default value: 49 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the TACACS+ server. Default value: 3 Minimum value: 1 tacacsSecret The key shared between the client and the server. This information is required for the system to communicate with the TACACS+ server. authorization The option for streaming authorization for the TACACS+ server. Possible values: ON, OFF accounting The option for sending accounting messages to the TACACS+ server. Possible values: ON, OFF Example To configure a TACACS+ server running at 192.168.1.20 set aaa tacacsparams -serverip 192.168.1.20 -tacacssecret secret Related Commands add authentication tacacsaction set aaa radiusparams set aaa parameter unset aaa tacacsParams show aaa tacacsParams
unset aaa tacacsParams

Synopsis unset aaa tacacsParams [-serverIP] [-serverPort] [-authTimeout] [-tacacsSecret] [-authorization] [-accounting] Description Use this command to remove aaa tacacsParams settings.Refer to the set aaa tacacsParams command for meanings of the arguments. Arguments Example
Related Commands set aaa tacacsParams show aaa tacacsParams
show aaa tacacsParams

Synopsis show aaa tacacsParams
Description Display configured AAA TACACS+ server parameters. Arguments format level serverIP The IP address of the TACACS+ server. serverPort The port on which the TACACS+ server is running. authTimeout The maximum number of seconds the system will wait for a response from the TACACS+ server. tacacsSecret The key shared between the client and the server. authorization The option for the streaming authorization for TACACS+ server. accounting The option to send accounting messages to TACACS+ server. Example > sh aaa tacacsparams Configured TACACS parameter Server IP: 192.168.1.20 Port: 49 Timeout: 1 secs Done Related Commands set aaa tacacsParams unset aaa tacacsParams
set aaa certParams

Synopsis set aaa certParams [-userNameField <string>] [-groupNameField <string>] Description Set the global variables for a certificate policy. It is used globally in SSL-VPN across all Vservers unless vserverspecific configuration is done using authentication policies. Arguments userNameField The field in the client certificate to extract the username from. Should be of the format <field:subfield>. Allowed values for field are "Subject" and "Issuer". groupNameField The certificate field to extract the group from. Should be of the format <field:subfield>. Allowed values for field are "Subject" and "Issuer". Example To configure the default certificate parameters: set aaa certparams -userNameField "Subject:CN" -groupNameField "Subject:OU"
Related Commands add authentication certaction set aaa parameter unset aaa certParams show aaa certParams
unset aaa certParams

Synopsis unset aaa certParams [-userNameField] [-groupNameField] Description Use this command to remove aaa certParams settings.Refer to the set aaa certParams command for meanings of the arguments. Arguments Example
Related Commands set aaa certParams show aaa certParams
show aaa certParams

Synopsis show aaa certParams Description Display the configured CERT parameters. Arguments format level twoFactor The state of the two-factor authentication. userNameField The field in the certificate from which the username will be extracted. groupNameField The field in the certificate from which the group will be extracted. Example
Related Commands set aaa certParams
unset aaa certParams
set aaa parameter

Synopsis set aaa parameter [-enableStaticPageCaching ( YES | NO )] [-defaultAuthType <defaultAuthType>] [-maxAAAUsers <positive_integer>] [-aaadnatIp <ip_addr|*>] Description Set the global AAA parameters. This will override the default authentication server setting. Arguments enableStaticPageCaching The default state of VPN Static Page caching. If nothing is specified, the default value is set to ON. Possible values: YES, NO Default value: STATIC_PAGE_CACHING_ENABLED defaultAuthType The default authentication server type. If nothing is specified, the default value is set to Local. Possible values: LOCAL, LDAP, RADIUS, TACACS, CERT Default value: LOCAL_AUTH maxAAAUsers The maximum number of concurrent users allowed to login in to the system at any given time. Minimum value: 1 Maximum value: 65535 aaadnatIp The source ip to be used for the traffic going to authentication servers Example set aaa parameter -defaultAuthType RADIUS -maxAAAUSers 100
Related Commands unset aaa parameter show aaa parameter
unset aaa parameter

Synopsis unset aaa parameter [-enableStaticPageCaching] [-defaultAuthType] [-maxAAAUsers] [-aaadnatIp] Description Set default aaa paramter.Refer to the set aaa parameter command for meanings of the arguments. Arguments Example
Related Commands set aaa parameter
show aaa parameter
show aaa parameter

Synopsis show aaa parameter Description Displays the configured AAA parameters . Arguments format level enableStaticPageCaching Indicates if static page caching is enabled or not. defaultAuthType The default authentication server type. maxAAAUsers The maximum number of concurrent users allowed to log into the system at any time. aaadnatIp The natIp to be used for the AAA traffic Example > show aaa parameter Configured AAA parameters DefaultAuthType: LDAP MaxAAAUsers: 5 Done >
Related Commands set aaa parameter unset aaa parameter
set aaa preauthenticationparameter

Synopsis set aaa preauthenticationparameter [-preauthenticationaction ( ALLOW | DENY )] [-rule <expression>] [-killProcess <string>] [-deletefiles <string>] Description Sets the default end point analysis (EPA) parameters before authentication. Arguments preauthenticationaction Deny or allow login after end point analysis results. Possible values: ALLOW, DENY rule The name of the rule, or expression, to be evaluated by the EPA tool.
killProcess Processes to be killed by the EPA tool. deletefiles Files to be deleted by the EPA tool. Example
Related Commands unset aaa preauthenticationparameter show aaa preauthenticationparameter
unset aaa preauthenticationparameter

Synopsis unset aaa preauthenticationparameter [-rule] [-preauthenticationaction] [-killProcess] [-deletefiles] Description Set default end point analysis(EPA) parameters before authentication. .Refer to the set aaa preauthenticationparameter command for meanings of the arguments. Arguments Example
Related Commands set aaa preauthenticationparameter show aaa preauthenticationparameter
show aaa preauthenticationparameter

Synopsis show aaa preauthenticationparameter Description Display details of the configured Pre-authentication parameter(s). Arguments format level preauthenticationaction Deny or allow login after End point analysis results. rule The name of the rule, or expression, to be evaluated by the EPA tool.
killProcess Processes to be killed by EPA tool. deletefiles Files to be deleted by EPA tool. Example
Related Commands set aaa preauthenticationparameter unset aaa preauthenticationparameter
bind aaa global

Synopsis bind aaa global (-policy <string> [-priority <positive_integer>]) Description Binds the policy globally. Arguments policy The policy to be bound globally. Example bind aaa global -pol pol1
Related Commands unbind aaa global show aaa global
unbind aaa global

Synopsis unbind aaa global -policy <string> Description Unbind the policy globally Arguments policy The policy to be unbound to the AAA user. Example
Related Commands bind aaa global show aaa global
show aaa global

Synopsis show aaa global Description Display details of the configured policies aaa global. Arguments summary fullValues format level policy The policy to be unbound to the AAA user. priority Priority of the bound policy bindPolicyType Bound policy type count stateflag Example
Related Commands bind aaa global unbind aaa global
Chapter
4
APP Commands
Topics: import application export application
94 | Citrix NetScaler 10 | APP Commands
import application
Synopsis import application <apptemplateFilename> [-appname <string>] [-deploymentFilename <input_filename>] Description imports an application specified in the apptemplate file Arguments apptemplateFilename Application template file name that contains application and variable definition appname Application name given for this import of configuration deploymentFilename Deployment file name that contains backend services, endpoints and variables Example import app application sampleapp -apptemplatefilename sampleapp.xml -deploymentfilename deploy.xml
Related Commands export application
export application
Synopsis export application <appname> [-apptemplateFilename <input_filename>] [-deploymentFilename <input_filename>] Description export app application sampleapp Arguments appname Application name that needs to be exported as template file apptemplateFilename Name of the tempalte file where application is stored deploymentFilename Name of the deployment file where deployment is stored Example
Related Commands import application
Chapter
5
AppFlow Commands
Topics: stat appflow add appflow collector rm appflow collector rename appflow collector show appflow collector add appflow action rm appflow action set appflow action unset appflow action rename appflow action show appflow action add appflow policy rm appflow policy set appflow policy unset appflow policy rename appflow policy show appflow policy add appflow policylabel rm appflow policylabel bind appflow policylabel unbind appflow policylabel rename appflow policylabel show appflow policylabel set appflow param unset appflow param show appflow param bind appflow global unbind appflow global show appflow global
96 | Citrix NetScaler 10 | AppFlow Commands
stat appflow
Synopsis stat appflow [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display AppFlow statistics. Arguments AppFlow octets transmitted (aflwOcts) The total number of AppFlow (IPFIX) octets that the NetScaler has transmitted. AppFlow flows transmitted (aflwFlws) The total number of AppFlow (IPFIX) flows that the NetScaler has transmitted. AppFlow messages transmitted (aflwMsgs) The total number of AppFlow (IPFIX) messages that the NetScaler has transmitted. Octets ignored for AppFlow (aflwIgnOct) The total number of octets that the NetScaler has ignored for AppFlow (IPFIX). Packets ignored for AppFlow (aflwIgnPkts) The total number of packets that the NetScaler has ignored for AppFlow (IPFIX). AppFlow octets not transmitted (aflwNoTxOcts) The total number of AppFlow (IPFIX) octets that the NetScaler has not transmitted. AppFlow flows not transmitted (aflwNoTxFlows) The total number of AppFlow (IPFIX) flows that the NetScaler has not transmitted. AppFlow packets not transmitted (aflwNoTxPkts) The total number of AppFlow (IPFIX) packets that the NetScaler has not transmitted. Example
Related Commands
add appflow collector

Synopsis add appflow collector <name> -IPAddress <ip_addr> [-port <port>] Description Add a new AppFlow collector. Arguments name Name of the AppFlow collector. IPAddress The IPv4 address of the AppFlow collector.
Citrix NetScaler 10 | AppFlow Commands | 97
port The UDP port on which the AppFlow collector is listening. Default value: 4739 Example add appflow collector collector1 -IPAddress 192.168.1.40 -port 2055
Related Commands rm appflow collector rename appflow collector show appflow collector
rm appflow collector
Synopsis rm appflow collector <name> Description Remove an AppFlow collector. Arguments name Name of an AppFlow collector. Example rm appflow collector collector1
Related Commands add appflow collector rename appflow collector show appflow collector
rename appflow collector

Synopsis rename appflow collector <name>@ <newName>@ Description Rename an AppFlow collector. Arguments name The name of an AppFlow collector. newName The new name of the AppFlow collector.
Example rename appflow collector old_name new_name Related Commands add appflow collector rm appflow collector show appflow collector
show appflow collector

Synopsis show appflow collector [<name>] Description Display details of all the AppFlow collectors configured on the system. Alternatively, to view the details of a particular AppFlow collector, specify its name. Arguments name Name of an AppFlow collector. summary fullValues format level IPAddress The IPv4 address of the AppFlow collector. port The UDP port on which the AppFlow collector is listening. count stateflag Example show appflow collector collector1 Related Commands add appflow collector rm appflow collector rename appflow collector
add appflow action

Synopsis add appflow action <name> -collectors <string> ... [-comment <string>]
Description Creates an AppFlow action. The action thus created can be associated with an AppFlow policy by using the "add appflow policy" command. Arguments name Name of the AppFlow action to be added. collectors The names of AppFlow collectors associated with the AppFlow action. comment Comments associated with this AppFlow action. Example add appflow action appflow_action_1 -collectors col1 col2
Related Commands rm appflow action set appflow action unset appflow action rename appflow action show appflow action
rm appflow action
Synopsis rm appflow action <name> Description Remove a configured AppFlow action. Arguments name Name of an AppFlow action. Example rm appflow action appflow_action_1
Related Commands add appflow action set appflow action unset appflow action rename appflow action show appflow action
set appflow action

Synopsis set appflow action <name> [-collectors <string> ...] [-comment <string>] Description Modify an AppFlow action. Arguments name The name of the AppFlow action to be modified. collectors The names of AppFlow collectors associated with the AppFlow action. comment Comments associated with this AppFlow action. Example set appflow action appflow_action_1 -collectors col1 col2 col3
Related Commands add appflow action rm appflow action unset appflow action rename appflow action show appflow action
unset appflow action

Synopsis unset appflow action <name> -comment Description Use this command to remove appflow action settings.Refer to the set appflow action command for meanings of the arguments. Arguments Example
Related Commands add appflow action rm appflow action set appflow action
rename appflow action show appflow action
rename appflow action

Synopsis rename appflow action <name>@ <newName>@ Description Rename an AppFlow action. Arguments name The name of an AppFlow action. newName The new name of the AppFlow action. Example rename appflow action old_name new_name
Related Commands add appflow action rm appflow action set appflow action unset appflow action show appflow action
show appflow action

Synopsis show appflow action [<name>] Description Display configured AppFlow action(s). Arguments name Name of an AppFlow action. summary fullValues format level stateflag
hits The number of times the action has been taken. collectors The names of AppFlow collectors associated with the AppFlow action. referenceCount The number of references to the action. description Description of the action comment Comments associated with the AppFlow action. count Example 1. show appflow action 2. show appflow action appflow_action_1
Related Commands add appflow action rm appflow action set appflow action unset appflow action rename appflow action
add appflow policy

Synopsis add appflow policy <name> <rule> <action> [-comment <string>] Description Add an AppFlow policy. Arguments name Name of the AppFlow policy. rule Expression to be used by the AppFlow policy. It has to be a boolean PI rule expression. action AppFlow action to be used by the policy. comment Comments associated with this AppFlow policy. Example add appflow policy appflow_pol "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh3\\")" appflow_act
Related Commands rm appflow policy set appflow policy unset appflow policy rename appflow policy show appflow policy
rm appflow policy
Synopsis rm appflow policy <name> Description Remove an AppFlow policy. Arguments name Name of the AppFlow policy to be removed. Example rm appflow policy appflow_policy_1
Related Commands add appflow policy set appflow policy unset appflow policy rename appflow policy show appflow policy
set appflow policy

Synopsis set appflow policy <name> [-rule <expression>] [-action <string>] [-comment <string>] Description Set a new rule and/or action for an existing AppFlow policy. The rule flow type can change only if: . action is of NEUTRAL flow type Arguments name Name of an AppFlow policy. rule Expression to be used by the AppFlow policy. It has to be a boolean PI rule expression. action AppFlow action to be used by the policy.
comment Comments associated with this AppFlow policy. Example set appflow policy appflow_policy -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\ \"qh2\\")"
Related Commands add appflow policy rm appflow policy unset appflow policy rename appflow policy show appflow policy
unset appflow policy

Synopsis unset appflow policy <name> -comment Description Use this command to remove appflow policy settings.Refer to the set appflow policy command for meanings of the arguments. Arguments Example
Related Commands add appflow policy rm appflow policy set appflow policy rename appflow policy show appflow policy
rename appflow policy

Synopsis rename appflow policy <name>@ <newName>@ Description Rename an AppFlow policy. Arguments name The name of an AppFlow policy.
newName The new name of the AppFlow policy. Example rename appflow policy old_name new_name
Related Commands add appflow policy rm appflow policy set appflow policy unset appflow policy show appflow policy
show appflow policy

Synopsis show appflow policy [<name>] Description Display all the configured AppFlow policies. Arguments name Name of an AppFlow policy. summary fullValues format level stateflag rule Expression to be used by AppFlow policy. action AppFlow action associated with the policy. hits Number of hits. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound. priority Specifies the priority of the policy. gotoPriorityExpression
Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policy comment Comments associated with this AppFlow policy. bindPolicyType vserverType count Example show appflow policy Related Commands add appflow policy rm appflow policy set appflow policy unset appflow policy rename appflow policy
add appflow policylabel

Synopsis add appflow policylabel <labelName> [-policylabeltype ( HTTP | OTHERTCP )] Description Create an AppFlow policy label. Arguments labelName The name of the AppFlow policy label to be created. policylabeltype The type of the policy label. Possible values: HTTP, OTHERTCP Default value: NS_PLTMAP_APPFLOW_REQ Example add appflow policylabel appflow_pol_label Related Commands rm appflow policylabel
bind appflow policylabel unbind appflow policylabel rename appflow policylabel show appflow policylabel
rm appflow policylabel
Synopsis rm appflow policylabel <labelName> Description Remove an AppFlow policy label. Arguments labelName The name of the AppFlow policy label to be removed. Example rm appflow policylabel appflow_pol_label
Related Commands add appflow policylabel bind appflow policylabel unbind appflow policylabel rename appflow policylabel show appflow policylabel
bind appflow policylabel

Synopsis bind appflow policylabel <labelName> -policyName <string> -priority <positive_integer> [-gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] Description Bind an AppFlow policy to an AppFlow policy label. Arguments labelName Name of an AppFlow policy label. policyName Name of an AppFlow policy. Example bind appflow policylabel appflow_pol_label -policyName appflow_pol -priority 1
Related Commands add appflow policylabel rm appflow policylabel unbind appflow policylabel rename appflow policylabel show appflow policylabel
unbind appflow policylabel

Synopsis unbind appflow policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind an AppFlow policy from an AppFlow policy label. Arguments labelName Name of an AppFlow policy label. policyName Name of an AppFlow policy. Example unbind appflow policylabel appflow_pol_label appflow_pol
Related Commands add appflow policylabel rm appflow policylabel bind appflow policylabel rename appflow policylabel show appflow policylabel
rename appflow policylabel

Synopsis rename appflow policylabel <labelName>@ <newName>@ Description Rename an AppFlow policy label. Arguments labelName The name of an AppFlow policylabel. newName The new name of the AppFlow policylabel.
Example rename appflow policylabel old_name new_name
Related Commands add appflow policylabel rm appflow policylabel bind appflow policylabel unbind appflow policylabel show appflow policylabel
show appflow policylabel

Synopsis show appflow policylabel [<labelName>] Description Display all AppFlow policy labels or all policies bound to an AppFlow policy label. Arguments labelName The name of the AppFlow policy label. summary fullValues format level stateflag type Specifies when policies bound to this policy label will be evaluated. numpol Number of polices bound to the policy label. hits Number of times the policy label was invoked. policyName Name of the AppFlow policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation.
labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound AppFlow policy. description Description of the policylabel flags count Example i) show appflow policylabel appflow_pol_label ii) show appflow policylabel Related Commands add appflow policylabel rm appflow policylabel bind appflow policylabel unbind appflow policylabel rename appflow policylabel
set appflow param

Synopsis set appflow param [-templateRefresh <secs>] [-appnameRefresh <secs>] [-flowRecordInterval <secs>] [-udpPmtu <positive_integer>] [-httpUrl ( ENABLED | DISABLED )] [-httpCookie ( ENABLED | DISABLED )] [-httpReferer ( ENABLED | DISABLED )] [-httpMethod ( ENABLED | DISABLED )] [-httpHost ( ENABLED | DISABLED )] [-httpUserAgent ( ENABLED | DISABLED )] [-clientTrafficOnly ( YES | NO )] [-httpContentType ( ENABLED | DISABLED )] [-httpAuthorization ( ENABLED | DISABLED )] [-httpVia ( ENABLED | DISABLED )] [httpLocation ( ENABLED | DISABLED )] [-httpSetCookie ( ENABLED | DISABLED )] [-httpSetCookie2 ( ENABLED | DISABLED )] Description Configure AppFlow parameters. Arguments templateRefresh IPFIX template refresh interval (in seconds). Default value: 600 Minimum value: 60 Maximum value: 3600 appnameRefresh Appname refresh interval (in seconds). Default value: 600 Minimum value: 60 Maximum value: 3600 flowRecordInterval IPFIX flow record export interval (in seconds). Default value: 600 Minimum value: 60 Maximum value: 3600 udpPmtu MTU to be used for IPFIX UDP packets. Default value: 1472 Minimum value: 128 Maximum value: 1472
httpUrl Enable AppFlow HTTP URL logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpCookie Enable AppFlow HTTP cookie logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpReferer Enable AppFlow HTTP referer logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpMethod Enable AppFlow HTTP method logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpHost Enable AppFlow HTTP host logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpUserAgent Enable AppFlow HTTP user-agent logging. Possible values: ENABLED, DISABLED Default value: DISABLED clientTrafficOnly Control whether AppFlow records should be generated only for client-side traffic. Possible values: YES, NO Default value: NO httpContentType Enable AppFlow HTTP Content-Type header logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpAuthorization Enable AppFlow HTTP Authorization header logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpVia Enable AppFlow HTTP Via header logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpLocation Enable AppFlow HTTP Location header logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpSetCookie Enable AppFlow HTTP Setcookie header logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpSetCookie2 Enable AppFlow HTTP Setcookie2 header logging. Possible values: ENABLED, DISABLED Default value: DISABLED Example set appflow param -templateRefresh 240 Related Commands unset appflow param show appflow param
unset appflow param

Synopsis unset appflow param [-templateRefresh] [-appnameRefresh] [-flowRecordInterval] [-udpPmtu] [-httpUrl] [httpCookie] [-httpReferer] [-httpMethod] [-httpHost] [-httpUserAgent] [-clientTrafficOnly] [-httpContentType] [httpAuthorization] [-httpVia] [-httpLocation] [-httpSetCookie] [-httpSetCookie2] Description Use this command to remove appflow param settings.Refer to the set appflow param command for meanings of the arguments. Arguments Example
Related Commands set appflow param show appflow param
show appflow param

Synopsis show appflow param Description Display AppFlow parameters. Arguments summary fullValues format level templateRefresh IPFIX template refresh interval (in seconds). appnameRefresh Appname refresh interval (in seconds). flowRecordInterval IPFIX flow record export interval (in seconds). udpPmtu MTU to be used for IPFIX UDP packets. httpUrl State of AppFlow HTTP URL logging.
httpCookie State of AppFlow HTTP cookie logging. httpReferer State of AppFlow HTTP referer logging. httpMethod State of AppFlow HTTP method logging. httpHost State of AppFlow HTTP host logging. httpUserAgent State of AppFlow HTTP user-agent logging. clientTrafficOnly Control whether AppFlow records should be generated only for client-side traffic. httpContentType State of AppFlow HTTP Content-Type header logging httpAuthorization State of AppFlow HTTP Authorization header logging httpVia State of AppFlow HTTP Via header logging httpLocation State of AppFlow HTTP Location header logging httpSetCookie State of AppFlow HTTP Setcookie header logging httpSetCookie2 State of AppFlow HTTP Setcookie2 header logging Example
Related Commands set appflow param unset appflow param
bind appflow global

Synopsis bind appflow global <policyName> <priority> [<gotoPriorityExpression>] [-type <type>] [-invoke (<labelType> <labelName>) ] Description Bind the AppFlow policy to one of the two global lists of AppFlow policies. A policy becomes active only after it is bound. All traffic will be evaluated against these two policy banks. Each bank of policies is an ordered list ordered by policies priority values. Policy Bank Evaluation The goal of evaluation is to traverse the ordered list of policies in the bank, find out which policies match and build a result set that will contain the actions of all the matching policies. While evaluating a policy if any advanced expression cannot be evaluated then UNDEF processing will get triggered. There are also other scenarios during policy traversal when UNDEF processing can get triggered. If an UNDEF event
occurs while processing a policy, then (i) policy bank traversal ends, (ii) the result set of actions that was built so far is wiped out (iii) the current policy's undefAction is put in the result set and the evaluation ends. Arguments policyName Name of an AppFlow policy. Example i) bind appflow global pol9 9 ii) bind appflow global pol9 9 120 iii) bind appflow global pol9 9 "HTTP.REQ.HEADER(\\"qh3\\").TYPECAST_NUM_T(DECIMAL)"
Related Commands unbind appflow global show appflow global
unbind appflow global

Synopsis unbind appflow global (<policyName> [-type <type>] [-priority <positive_integer>]) Description Unbind entities from AppFlow global. Arguments policyName Name of an AppFlow policy. Example unbind appflow global pol9
Related Commands bind appflow global show appflow global
show appflow global

Synopsis show appflow global [-type <type>] Description Display the AppFlow global bindings. Arguments type The bindpoint to which the policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT, OVERRIDE, DEFAULT, OTHERTCP_REQ_OVERRIDE, OTHERTCP_REQ_DEFAULT,
MSSQL_REQ_OVERRIDE, MSSQL_REQ_DEFAULT, MYSQL_REQ_OVERRIDE, MYSQL_REQ_DEFAULT summary fullValues format level stateflag policyName Name of the AppFlow policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. numpol The number of policies bound to the bindpoint. flowType Flow type of the bound AppFlow policy. flags count Example show appflow global
Related Commands bind appflow global unbind appflow global
Chapter
6
Application Firewall Commands
Topics: stat appfw add appfw fieldType rm appfw fieldType set appfw fieldType show appfw fieldType add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile add appfw policy rm appfw policy set appfw policy unset appfw policy show appfw policy stat appfw policy rename appfw policy add appfw policylabel rm appfw policylabel bind appfw policylabel unbind appfw policylabel show appfw policylabel stat appfw policylabel rename appfw policylabel add appfw confidField rm appfw confidField set appfw confidField unset appfw confidField show appfw confidField show appfw stats rm appfw customSettings
118 | Citrix NetScaler 10 | Application Firewall Commands
show appfw customSettings import appfw customSettings update appfw customSettings rm appfw xmlerrorpage show appfw xmlerrorpage import appfw xmlerrorpage update appfw xmlerrorpage rm appfw htmlerrorpage show appfw htmlerrorpage import appfw htmlerrorpage update appfw htmlerrorpage set appfw settings unset appfw settings show appfw settings bind appfw global unbind appfw global show appfw global set appfw learningsettings unset appfw learningsettings show appfw learningsettings rm appfw learningdata show appfw learningdata reset appfw learningdata export appfw learningdata rm appfw wsdl show appfw wsdl import appfw wsdl rm appfw signatures show appfw signatures import appfw signatures update appfw signatures rm appfw xmlschema show appfw xmlschema import appfw xmlschema add appfw XMLContentType rm appfw XMLContentType show appfw XMLContentType show appfw archive export appfw archive import appfw archive rm appfw archive
Citrix NetScaler 10 | Application Firewall Commands | 119
stat appfw
Synopsis stat appfw [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display Application Firewall stats. Arguments total violations (totviols) Total number of security check violations seen by the Application Firewall. Recent Ave Response Time (ms) (shortAvgRespTime) Average backend response time in milliseconds over the last 7 seconds Long Term Ave Response Time (ms) (longAvgRespTime) Average backend response time in milliseconds since reboot requests (reqs) HTTP/HTTPS requests sent to your protected web servers via the Application Firewall. Request Bytes (reqBytes) Number of bytes transfered for requests responses (resps) HTTP/HTTPS responses sent by your protected web servers via the Application Firewall. Response Bytes (resBytes) Number of bytes transfered for responses aborts Incomplete HTTP/HTTPS requests aborted by the client before the Application Firewall could finish processing them. redirects (redirect) HTTP/HTTPS requests redirected by the Application Firewall to a different Web page or web server. (HTTP 302) Traps Dropped (trapsDr) AppFirewall SNMP traps dropped due to time limit. start URL (startURL) Number of Start URL security check violations seen by the Application Firewall. deny URL (denyURL) Number of Deny URL security check violations seen by the Application Firewall. referer header (refererHdr) Number of Referer Header security check violations seen by the Application Firewall. buffer overflow (bufovfl) Number of Buffer Overflow security check violations seen by the Application Firewall. cookie consistency (cookie) Number of Cookie Consistency security check violations seen by the Application Firewall. CSRF form tag (csrf_tag) Number of Cross Site Request Forgery form tag security check violations seen by the Application Firewall.
HTML Cross-site scripting (xss) Number of HTML Cross-Site Scripting security check violations seen by the Application Firewall. HTML SQL injection (sql) Number of HTML SQL Injection security check violations seen by the Application Firewall. field format (fieldfmt) Number of Field Format security check violations seen by the Application Firewall. field consistency (fieldcon) Number of Field Consistency security check violations seen by the Application Firewall. credit card (ccard) Number of Credit Card security check violations seen by the Application Firewall. safe object (safeobj) Number of Safe Object security check violations seen by the Application Firewall. Signature Violations (sigs) Number of Signature violations seen by the Application Firewall. XML Format (wfcViolations) Number of XML Format security check violations seen by the Application Firewall. XML Denial of Service (XDoS) (xdosViolations) Number of XML Denial-of-Service security check violations seen by the Application Firewall. XML Message Validation (msgvalViolations) Number of XML Message Validation security check violations seen by the Application Firewall. Web Services Interoperability (wsIViolations) Number of Web Services Interoperability (WS-I) security check violations seen by the Application Firewall. XML SQL Injection (xmlSqlViolations) Number of XML SQL Injection security check violations seen by the Application Firewall. XML Cross-Site Scripting (xmlXssViolations) Number of XML Cross-Site Scripting (XSS) security check violations seen by the Application Firewall. XML Attachment (xmlAttachmentViolations) Number of XML Attachment security check violations seen by the Application Firewall. SOAP Fault Violations (soapflt) Number of requests returning soap:fault from the backend server XML Generic Violations (genflt) Number of requests returning XML generic error from the backend server HTTP Client Errors (4xx Resp) (4xxResps) Number of requests returning HTTP 4xx from the backend server HTTP Server Errors (5xx Resp) (5xxResps) Number of requests returning HTTP 5xx from the backend server Example
Related Commands stat appfw profile
stat appfw policy stat appfw policylabel
add appfw fieldType

Synopsis add appfw fieldType <name> <regex> <priority> [-comment <string>] Description Add an Application Firewall field type. Field types define the type of data that can appear in a web form field. The Learning engine uses the field types list to generate appropriate field type assignments for the field formats check. Arguments name The name of this field type. regex The regular expression that describes this field type. priority The priority of this field type. Maximum value: 64000 comment Comments associated with this field type. Example
Related Commands rm appfw fieldType set appfw fieldType show appfw fieldType
rm appfw fieldType
Synopsis rm appfw fieldType <name> Description Remove an Application Firewall field type. Field types define the type of data that can appear in a web form field. The Learning engine uses the field types list to generate appropriate field type assignments for the field formats check. Arguments name The name of this field type. Example
Related Commands add appfw fieldType
set appfw fieldType show appfw fieldType
set appfw fieldType

Synopsis set appfw fieldType <name> <regex> <priority> [-comment <string>] Description Modify an Application Firewall field type. Field types define the type of data that can appear in a web form field. The Learning engine uses the field types list to generate appropriate field type assignments for the field formats check. Arguments name The name of this field type. regex The regular expression that describes this field type. Example
Related Commands add appfw fieldType rm appfw fieldType show appfw fieldType
show appfw fieldType

Synopsis show appfw fieldType [<name>] Description Display all configured Application Firewall form field types. Arguments name The name of this field type. summary fullValues format level regex The regular expression that describes this field type. priority
The priority of this field type. comment Comments associated with this field type. count stateflag Example
Related Commands add appfw fieldType rm appfw fieldType set appfw fieldType
add appfw profile

Synopsis add appfw profile <name> [-defaults ( basic | advanced )] [-startURLAction <startURLAction> ...] [-startURLClosure ( ON | OFF )] [-denyURLAction <denyURLAction> ...] [-RefererHeaderCheck <RefererHeaderCheck>] [-cookieConsistencyAction <cookieConsistencyAction> ...] [-cookieTransforms ( ON | OFF )] [-cookieEncryption <cookieEncryption>] [-cookieProxying ( none | sessionOnly )] [-addCookieFlags <addCookieFlags>] [-fieldConsistencyAction <fieldConsistencyAction> ...] [-CSRFtagAction <CSRFtagAction> ...] [-crossSiteScriptingAction <crossSiteScriptingAction> ...] [-crossSiteScriptingTransformUnsafeHTML ( ON | OFF )] [-crossSiteScriptingCheckCompleteURLs ( ON | OFF )] [-SQLInjectionAction <SQLInjectionAction> ...] [-SQLInjectionTransformSpecialChars ( ON | OFF )] [-SQLInjectionOnlyCheckFieldsWithSQLChars ( ON | OFF )] [-fieldFormatAction <fieldFormatAction> ...] [-defaultFieldFormatType <string>] [defaultFieldFormatMinLength <positive_integer>] [-defaultFieldFormatMaxLength <positive_integer>] [bufferOverflowAction <bufferOverflowAction> ...] [-bufferOverflowMaxURLLength <positive_integer>] [bufferOverflowMaxHeaderLength <positive_integer>] [-bufferOverflowMaxCookieLength <positive_integer>] [creditCardAction <creditCardAction> ...] [-creditCard <creditCard> ...] [-creditCardMaxAllowed <positive_integer>] [-creditCardXOut ( ON | OFF )] [-requestContentType <string>] [-responseContentType <string>] [XMLDoSAction <XMLDoSAction> ...] [-XMLFormatAction <XMLFormatAction> ...] [-XMLSQLInjectionAction <XMLSQLInjectionAction> ...] [-XMLSQLInjectionOnlyCheckFieldsWithSQLChars ( ON | OFF )] [XMLSQLInjectionParseComments <XMLSQLInjectionParseComments>] [-XMLXSSAction <XMLXSSAction> ...] [-XMLWSIAction <XMLWSIAction> ...] [-XMLAttachmentAction <XMLAttachmentAction> ...] [XMLValidationAction <XMLValidationAction> ...] [-XMLErrorObject <string>] [-signatures <string>] [XMLSOAPFaultAction <XMLSOAPFaultAction> ...] [-useHTMLErrorObject ( ON | OFF )] [-errorURL <expression>] [-HTMLErrorObject <string>] [-logEveryPolicyHit ( ON | OFF )] [-stripHtmlComments <stripHtmlComments>] [-stripXmlComments ( none | all )] [-exemptClosureURLsFromSecurityChecks ( ON | OFF )] [-defaultCharSet <string>] [-postBodyLimit <positive_integer>] [-fileUploadMaxNum <positive_integer>] [-canonicalizeHTMLResponse ( ON | OFF )] [-enableFormTagging ( ON | OFF )] [-sessionlessFieldConsistency <sessionlessFieldConsistency>] [-sessionlessURLClosure ( ON | OFF )] [-semicolonFieldSeparator ( ON | OFF )] [excludeFileUploadFromChecks ( ON | OFF )] [-SQLInjectionParseComments <SQLInjectionParseComments>] [invalidPercentHandling <invalidPercentHandling>] [-type ( HTML | XML ) ...] [-checkRequestHeaders ( ON | OFF )] [-comment <string>] Description Add an Application Firewall profile. A profile tells the Application Firewall how it should protect a given class of web content. Different types of content often require different protection strategies. You define these strategies in a profile. You can create profiles with basic or advanced defaults. The defaults, or predefined settings, provide solid initial protection for web content - a starting point from which you can configure additional protection for special
content. Each profile is associated with a policy that tells the Application Firewall the content type of a request or response. When a request or response matches the policy, that profile is applied. Arguments name Application Firewall profile name. defaults Default Start URLs and Deny URLs. Possible values: basic, advanced builtin Indicates that a profile is a built-in entity. builtinType Type of built-in Profile. Possible values: APPFW_NOT_BUILTIN, APPFW_BYPASS, APPFW_BLOCK, APPFW_RESET, APPFW_DROP startURLAction Start URL action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. Default value: AS_DEFAULT_DISPOSITION startURLClosure Start URL closure. This check is applicable to Profile Type: HTML, XML. Possible values: ON, OFF Default value: OFF denyURLAction Deny URL action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION RefererHeaderCheck Referer header check This check is applicable to Profile Type: HTML. Possible values: OFF, if_present, always Default value: AS_HEADER_CHECK_OFF cookieConsistencyAction Cookie consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. Default value: AS_NONE cookieTransforms Enable cookie transforms: encryption, proxying, and adding cookie flags. Make sure this is turned ON if you want the transforms to happen. This check is applicable to Profile Type: HTML. XML Possible values: ON, OFF Default value: OFF cookieEncryption Encrypts server cookies Possible values: none, decryptOnly, encryptSessionOnly, encryptAll Default value: AS_CKI_ENCRYPT_NONE cookieProxying Proxy server cookies using an Application Firewall session Possible values: none, sessionOnly Default value: AS_CKI_PROXY_NONE addCookieFlags Add HttpOnly and/or Secure flags to cookies Possible values: none, httpOnly, secure, all Default value: AS_ADD_CKI_FLAGS_NONE fieldConsistencyAction Form Field Consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_NONE CSRFtagAction Cross-site request forgery tag action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. LEARN is not supported. Default value: AS_NONE
crossSiteScriptingAction Cross-site scripting action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION crossSiteScriptingTransformUnsafeHTML Transform HTML characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF crossSiteScriptingCheckCompleteURLs Check complete URLs. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF SQLInjectionAction SQL injection action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION SQLInjectionTransformSpecialChars Transform HTML characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF SQLInjectionOnlyCheckFieldsWithSQLChars Check SQL characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON fieldFormatAction Field format action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION defaultFieldFormatType Default field type. This check is applicable to Profile Type: HTML. defaultFieldFormatMinLength Default field type minimum length. This check is applicable to Profile Type: HTML. Default value: AS_DEFAULTFIELDFORMAT_DEFAULT_MIN_LEN Maximum value: 65535 defaultFieldFormatMaxLength Default field type maximum length. This check is applicable to Profile Type: HTML. Default value: AS_DEFAULTFIELDFORMAT_DEFAULT_MAX_LEN Minimum value: 1 Maximum value: 65535 bufferOverflowAction Buffer overflow action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION bufferOverflowMaxURLLength Maximum URL length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_URL_LEN Maximum value: 65535 bufferOverflowMaxHeaderLength Maximum header length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_HDR_LEN Maximum value: 65535 bufferOverflowMaxCookieLength Maximum cookie length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_COOKIE_LEN Maximum value: 65535 creditCardAction Credit Card action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_NONE creditCard
Credit card. This check is applicable to Profile Type: HTML, XML. Default value: AS_CCARD_DEFAULT_CARD_TYPE creditCardMaxAllowed Maximum number of times a credit card number may be seen before action is taken. This check is applicable to Profile Type: HTML, XML. Maximum value: 255 creditCardXOut X-out the credit card numbers. This check is applicable to Profile Type: HTML, XML. Possible values: ON, OFF Default value: OFF requestContentType Default content-type for request messages. This binding is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_DEFAULT_REQUEST_CONTENT_TYPE responseContentType Default content-type for response messages. This binding is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_DEFAULT_RESPONSE_CONTENT_TYPE XMLDoSAction XML DOS action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLFormatAction XML well-formed request action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLSQLInjectionAction XML SQL injection action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLSQLInjectionOnlyCheckFieldsWithSQLChars Check SQL characters. This check is applicable to Profile Type: XML. Possible values: ON, OFF Default value: ON XMLSQLInjectionParseComments Canonicalize SQL Comments in XML Data. This check is applicable to Profile Type: XML. Possible values: checkall, ansi, nested, ansinested Default value: AS_CHECKALL XMLXSSAction XML cross-site scripting action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLWSIAction XML WS-I action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLAttachmentAction XML attachment action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLValidationAction XML validation action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLErrorObject Object name for the xml error page. This check is applicable to Profile Type: XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT customSettings
Object name for custom settings. This check is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT signatures Object name for signatures. This check is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT XMLSOAPFaultAction XML SOAP fault filtering action types. (BLOCK | LOG | STATS | REMOVE | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION useHTMLErrorObject Use HTML Error object for response instead of Redirect Error URL. Possible values: ON, OFF Default value: OFF errorURL Error page. This check is applicable to Profile Type: HTML. Default value: NS_S_AS_ERROR_URL_DEFAULT HTMLErrorObject Object name for the html error page. This check is applicable to Profile Type: HTML. Default value: NS_S_AS_ERROROBJECT_DEFAULT logEveryPolicyHit Log every profile match regardless of security checks results. Possible values: ON, OFF Default value: OFF stripComments Strip HTML comments. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF stripHtmlComments Strip HTML comments. This check is applicable to Profile Type: HTML. Possible values: none, all, exclude_script_tag Default value: AS_STRIP_COMMENT_NONE stripXmlComments Strip XML comments. This check is applicable to Profile Type: XML. Possible values: none, all Default value: AS_STRIP_COMMENT_NONE exemptClosureURLsFromSecurityChecks Tells the Application Firewall to exempt closure URLs from security checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON defaultCharSet Default character set. Possible values are iso-8859-1 (English US), big5 (Chinese Traditional), gb2312 (Chinese Simplified), sjis (Japanese), euc-jp (Japanese EUC-JP), utf-8 (Unicode), and euc-kr (Korean). This check is applicable to Profile Type: HTML. Default value: NS_S_AS_CHARSET_DEFAULT Maximum value: 31 postBodyLimit Maximum allowed post body size. This check is applicable to Profile Type: HTML, XML. Default value: AS_DEFAULT_POSTBODYLIMIT Maximum value: 1000000000 fileUploadMaxNum Maximum allowed number of file uploads per form submission request. Setting this parameter to the maximum value of 65535 will allow an unlimited number of uploads. Default value: AS_DEFAULT_MAX_FILE_UPLOADS Maximum value: 65535 canonicalizeHTMLResponse
Entity encoding for html special characters for attributes in the response. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON enableFormTagging Enable Tagging of Forms for Field Consistency Checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON sessionlessFieldConsistency Enable session less Field Consistency Checks. This check is applicable to Profile Type: HTML. Possible values: OFF, ON, postOnly Default value: AS_OFF sessionlessURLClosure Enable session less URL Closure Checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF semicolonFieldSeparator Allow ';' as a form field separator in URL queries and POST form bodies This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON excludeFileUploadFromChecks Exclude Uploaded Files from Form checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF SQLInjectionParseComments Canonicalize SQL Comments in form fields. This check is applicable to Profile Type: HTML. Possible values: checkall, ansi, nested, ansinested Default value: AS_DEFAULT_SQLINJECTIONPARSECOMMENTS invalidPercentHandling Options for handling percent-encoded names and values. Possible values: apache_mode, asp_mode, secure_mode Default value: AS_PERCENT_DECODE_SECURE_MODE type Defines the type of the Application Firewall Profile. If the profile is of type XML, then you can only set security checks that are relevent to XML. Similary, if the profile type is HTML then you can set only security checks that are relevant to HTML. Composite profile types can have HTML and XML checks. Default value: AF_PROFILE_TYPE_HTML checkRequestHeaders Check for XSS and SQL injections in request headers. Possible values: ON, OFF Default value: OFF comment Comments associated with this profile. Example
Related Commands rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile
archive appfw profile restore appfw profile
rm appfw profile
Synopsis rm appfw profile <name> Description Remove an Application Firewall profile. Arguments name Application Firewall profile name. Example Related Commands add appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile
set appfw profile

Synopsis set appfw profile <name> [-startURLAction <startURLAction> ...] [-startURLClosure ( ON | OFF )] [-denyURLAction <denyURLAction> ...] [-RefererHeaderCheck <RefererHeaderCheck>] [cookieConsistencyAction <cookieConsistencyAction> ...] [-cookieTransforms ( ON | OFF )] [-cookieEncryption <cookieEncryption>] [-cookieProxying ( none | sessionOnly )] [-addCookieFlags <addCookieFlags>] [-fieldConsistencyAction <fieldConsistencyAction> ...] [-CSRFtagAction <CSRFtagAction> ...] [crossSiteScriptingAction <crossSiteScriptingAction> ...] [-crossSiteScriptingTransformUnsafeHTML ( ON | OFF )] [-crossSiteScriptingCheckCompleteURLs ( ON | OFF )] [-SQLInjectionAction <SQLInjectionAction> ...] [-SQLInjectionTransformSpecialChars ( ON | OFF )] [-SQLInjectionOnlyCheckFieldsWithSQLChars ( ON | OFF )] [-fieldFormatAction <fieldFormatAction> ...] [-defaultFieldFormatType <string>] [defaultFieldFormatMinLength <positive_integer>] [-defaultFieldFormatMaxLength <positive_integer>] [bufferOverflowAction <bufferOverflowAction> ...] [-bufferOverflowMaxURLLength <positive_integer>] [bufferOverflowMaxHeaderLength <positive_integer>] [-bufferOverflowMaxCookieLength <positive_integer>] [creditCardAction <creditCardAction> ...] [-creditCard <creditCard> ...] [-creditCardMaxAllowed <positive_integer>] [-creditCardXOut ( ON | OFF )] [-requestContentType <string>] [-responseContentType <string>] [XMLDoSAction <XMLDoSAction> ...] [-XMLFormatAction <XMLFormatAction> ...] [-XMLSQLInjectionAction <XMLSQLInjectionAction> ...] [-XMLSQLInjectionOnlyCheckFieldsWithSQLChars ( ON | OFF )] [XMLSQLInjectionParseComments <XMLSQLInjectionParseComments>] [-XMLXSSAction <XMLXSSAction> ...] [-XMLWSIAction <XMLWSIAction> ...] [-XMLAttachmentAction <XMLAttachmentAction> ...] [XMLValidationAction <XMLValidationAction> ...] [-XMLErrorObject <string>] [-signatures <string>] [XMLSOAPFaultAction <XMLSOAPFaultAction> ...] [-useHTMLErrorObject ( ON | OFF )] [-errorURL
<expression>] [-HTMLErrorObject <string>] [-logEveryPolicyHit ( ON | OFF )] [-stripHtmlComments <stripHtmlComments>] [-stripXmlComments ( none | all )] [-exemptClosureURLsFromSecurityChecks ( ON | OFF )] [-defaultCharSet <string>] [-postBodyLimit <positive_integer>] [-fileUploadMaxNum <positive_integer>] [-canonicalizeHTMLResponse ( ON | OFF )] [-enableFormTagging ( ON | OFF )] [-sessionlessFieldConsistency <sessionlessFieldConsistency>] [-sessionlessURLClosure ( ON | OFF )] [-semicolonFieldSeparator ( ON | OFF )] [excludeFileUploadFromChecks ( ON | OFF )] [-SQLInjectionParseComments <SQLInjectionParseComments>] [invalidPercentHandling <invalidPercentHandling>] [-type ( HTML | XML ) ...] [-checkRequestHeaders ( ON | OFF )] [-comment <string>] Description Modify the settings for a given Application Firewall profile. Arguments name Application Firewall profile name. startURLAction Start URL action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. Default value: AS_DEFAULT_DISPOSITION startURLClosure Start URL closure. This check is applicable to Profile Type: HTML, XML. Possible values: ON, OFF Default value: OFF denyURLAction Deny URL action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION RefererHeaderCheck Referer header check This check is applicable to Profile Type: HTML. Possible values: OFF, if_present, always Default value: AS_HEADER_CHECK_OFF cookieConsistencyAction Cookie consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. Default value: AS_NONE cookieTransforms Enable cookie transforms: encryption, proxying, and adding cookie flags. Make sure this is turned ON if you want the transforms to happen. This check is applicable to Profile Type: HTML. XML Possible values: ON, OFF cookieEncryption Encrypts server cookies Possible values: none, decryptOnly, encryptSessionOnly, encryptAll Default value: AS_CKI_ENCRYPT_NONE cookieProxying Proxy server cookies using an Application Firewall session Possible values: none, sessionOnly Default value: AS_CKI_PROXY_NONE addCookieFlags Add HttpOnly and Secure flags to cookies Possible values: none, httpOnly, secure, all Default value: AS_ADD_CKI_FLAGS_NONE fieldConsistencyAction Form Field Consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_NONE CSRFtagAction Cross-site request forgery tag action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. LEARN is not supported. Default value: AS_NONE crossSiteScriptingAction
Cross-site scripting action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION crossSiteScriptingTransformUnsafeHTML Transform HTML characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF crossSiteScriptingCheckCompleteURLs Check complete URLs. This check is applicable to Profile Type: HTML. Possible values: ON, OFF SQLInjectionAction SQL injection action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION SQLInjectionTransformSpecialChars Transform HTML characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF SQLInjectionOnlyCheckFieldsWithSQLChars Check SQL characters. This check is applicable to Profile Type: HTML. Possible values: ON, OFF fieldFormatAction Field format action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: HTML. Default value: AS_DEFAULT_DISPOSITION defaultFieldFormatType Default field type. This check is applicable to Profile Type: HTML. defaultFieldFormatMinLength Default field type minimum length. This check is applicable to Profile Type: HTML. Default value: AS_DEFAULTFIELDFORMAT_DEFAULT_MIN_LEN Maximum value: 65535 defaultFieldFormatMaxLength Default field type maximum length. This check is applicable to Profile Type: HTML. Default value: AS_DEFAULTFIELDFORMAT_DEFAULT_MAX_LEN Minimum value: 1 Maximum value: 65535 bufferOverflowAction Buffer overflow action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION bufferOverflowMaxURLLength Maximum URL length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_URL_LEN Maximum value: 65535 bufferOverflowMaxHeaderLength Maximum header length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_HDR_LEN Maximum value: 65535 bufferOverflowMaxCookieLength Maximum cookie length. This check is applicable to Profile Type: HTML, XML. Default value: AS_BUFFEROVERFLOW_DEFAULT_MAX_COOKIE_LEN Maximum value: 65535 creditCardAction Credit Card action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: HTML, XML. LEARN is not supported. Default value: AS_NONE creditCard Credit card. This check is applicable to Profile Type: HTML, XML. Default value: AS_CCARD_DEFAULT_CARD_TYPE creditCardMaxAllowed
Maximum number of times a credit card number may be seen before action is taken. This check is applicable to Profile Type: HTML, XML. Maximum value: 255 creditCardXOut X-out the credit card numbers. This check is applicable to Profile Type: HTML, XML. Possible values: ON, OFF requestContentType Default content-type for request messages. This binding is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_DEFAULT_REQUEST_CONTENT_TYPE responseContentType Default content-type for response messages. This binding is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_DEFAULT_RESPONSE_CONTENT_TYPE XMLDoSAction XML DOS action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLFormatAction XML well-formed request action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLSQLInjectionAction XML SQL injection action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLSQLInjectionOnlyCheckFieldsWithSQLChars Check SQL characters. This check is applicable to Profile Type: XML. Possible values: ON, OFF XMLSQLInjectionParseComments Canonicalize SQL Comments in XML Data. This check is applicable to Profile Type: XML. Possible values: checkall, ansi, nested, ansinested Default value: AS_CHECKALL XMLXSSAction XML cross-site scripting action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLWSIAction XML WS-I action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLAttachmentAction XML attachment action types. (BLOCK | LEARN | LOG | STATS | NONE) This check is applicable to Profile Type: XML. Default value: AS_DEFAULT_DISPOSITION XMLValidationAction XML validation action types. (BLOCK | LOG | STATS | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION XMLErrorObject Object name for the xml error page. This check is applicable to Profile Type: XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT customSettings Object name for custom settings. This check is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT signatures Object name for signatures. This check is applicable to Profile Type: HTML, XML. Default value: NS_S_AS_ERROROBJECT_DEFAULT
XMLSOAPFaultAction XML SOAP fault filtering action types. (BLOCK | LOG | STATS | REMOVE | NONE) This check is applicable to Profile Type: XML. LEARN is not supported. Default value: AS_DEFAULT_DISPOSITION useHTMLErrorObject Use HTML Error object for response instead of Redirect Error URL. Possible values: ON, OFF errorURL Error page. This check is applicable to Profile Type: HTML. Default value: NS_S_AS_ERROR_URL_DEFAULT HTMLErrorObject Object name for the html error page. This check is applicable to Profile Type: HTML. Default value: NS_S_AS_ERROROBJECT_DEFAULT logEveryPolicyHit Log every profile match regardless of security checks results. Possible values: ON, OFF stripComments Strip HTML comments. This check is applicable to Profile Type: HTML. Possible values: ON, OFF stripHtmlComments Strip HTML comments. This check is applicable to Profile Type: HTML. Possible values: none, all, exclude_script_tag stripXmlComments Strip XML comments. This check is applicable to Profile Type: XML. Possible values: none, all exemptClosureURLsFromSecurityChecks Tells the Application Firewall to exempt closure URLs from security checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF defaultCharSet Default character set. Possible values are iso-8859-1 (English US), big5 (Chinese Traditional), gb2312 (Chinese Simplified), sjis (Japanese), euc-jp (Japanese EUC-JP), utf-8 (Unicode), and euc-kr (Korean). This check is applicable to Profile Type: HTML. Default value: NS_S_AS_CHARSET_DEFAULT Maximum value: 31 postBodyLimit Maximum allowed post body size. This check is applicable to Profile Type: HTML, XML. Default value: AS_DEFAULT_POSTBODYLIMIT Maximum value: 1000000000 fileUploadMaxNum Maximum allowed number of file uploads per form submission request. Setting this parameter to the maximum value of 65535 will allow an unlimited number of uploads. Default value: AS_DEFAULT_MAX_FILE_UPLOADS Maximum value: 65535 canonicalizeHTMLResponse Entity encoding for html special characters for attributes in the response. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON enableFormTagging Enable Tagging of Forms for Field Consistency Checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON sessionlessFieldConsistency Enable session less Field Consistency Checks. This check is applicable to Profile Type: HTML. Possible values: OFF, ON, postOnly Default value: AS_OFF sessionlessURLClosure
Enable session less URL Closure Checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF semicolonFieldSeparator Allow ';' as a form field separator in URL queries and POST form bodies This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: ON excludeFileUploadFromChecks Exclude Uploaded Files from Form checks. This check is applicable to Profile Type: HTML. Possible values: ON, OFF Default value: OFF SQLInjectionParseComments Canonicalize SQL Comments in form fields. This check is applicable to Profile Type: HTML. Possible values: checkall, ansi, nested, ansinested Default value: AS_DEFAULT_SQLINJECTIONPARSECOMMENTS invalidPercentHandling Options for handling percent-encoded names and values. Possible values: apache_mode, asp_mode, secure_mode Default value: AS_PERCENT_DECODE_SECURE_MODE type Defines the type of the Application Firewall Profile. If the profile is of type XML, then you can only set security checks that are relevent to XML. Similary, if the profile type is HTML then you can set only security checks that are relevant to HTML. Composite profile types can have HTML and XML checks. Default value: AF_PROFILE_TYPE_HTML checkRequestHeaders Check for XSS and SQL injections in request headers. Possible values: ON, OFF Default value: OFF comment Comments associated with this profile. Example Related Commands add appfw profile rm appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile
unset appfw profile

Synopsis unset appfw profile <name> [-startURLAction] [-startURLClosure] [-denyURLAction] [-RefererHeaderCheck] [-cookieConsistencyAction] [-cookieTransforms] [-cookieEncryption] [-cookieProxying] [-addCookieFlags] [fieldConsistencyAction] [-CSRFtagAction] [-crossSiteScriptingAction] [-crossSiteScriptingTransformUnsafeHTML] [-crossSiteScriptingCheckCompleteURLs] [-SQLInjectionAction] [-SQLInjectionTransformSpecialChars]
[-SQLInjectionOnlyCheckFieldsWithSQLChars] [-fieldFormatAction] [-defaultFieldFormatType] [-defaultFieldFormatMinLength] [-defaultFieldFormatMaxLength] [-bufferOverflowAction] [bufferOverflowMaxURLLength] [-bufferOverflowMaxHeaderLength] [-bufferOverflowMaxCookieLength] [-creditCardAction] [-creditCard] [-creditCardMaxAllowed] [-creditCardXOut] [-requestContentType] [-responseContentType] [-XMLDoSAction] [-XMLFormatAction] [-XMLSQLInjectionAction] [XMLSQLInjectionOnlyCheckFieldsWithSQLChars] [-XMLSQLInjectionParseComments] [-XMLXSSAction] [-XMLWSIAction] [-XMLAttachmentAction] [-XMLValidationAction] [-XMLErrorObject] [signatures] [-XMLSOAPFaultAction] [-useHTMLErrorObject] [-errorURL] [-HTMLErrorObject] [logEveryPolicyHit] [-stripHtmlComments] [-stripXmlComments] [-exemptClosureURLsFromSecurityChecks] [-defaultCharSet] [-postBodyLimit] [-fileUploadMaxNum] [-canonicalizeHTMLResponse] [enableFormTagging] [-sessionlessFieldConsistency] [-sessionlessURLClosure] [-semicolonFieldSeparator] [-excludeFileUploadFromChecks] [-SQLInjectionParseComments] [-invalidPercentHandling] [-type] [checkRequestHeaders] [-comment] Description Use this command to remove appfw profile settings.Refer to the set appfw profile command for meanings of the arguments. Arguments Example
Related Commands add appfw profile rm appfw profile set appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile
bind appfw profile

Synopsis bind appfw profile <name> (-startURL <expression> | -denyURL <expression> | (-fieldConsistency <string> <formActionURL> [-isRegex ( REGEX | NOTREGEX )]) | (-cookieConsistency <string> [-isRegex ( REGEX | NOTREGEX )]) | (-SQLInjection <string> <formActionURL> [-isRegex ( REGEX | NOTREGEX )] [location <location>]) | (-CSRFTag <expression> <CSRFFormActionURL>) | (-crossSiteScripting <string> <formActionURL> [-isRegex ( REGEX | NOTREGEX )] [-location <location>]) | (-fieldFormat <string> <formActionURL> <fieldType> [-fieldFormatMinLength <positive_integer>] [-fieldFormatMaxLength <positive_integer>] [-isRegex ( REGEX | NOTREGEX )]) | (-safeObject <string> <expression> <maxMatchLength> [-action <action> ...]) | (-XMLDoSURL <expression> [-XMLMaxElementDepthCheck ( ON | OFF ) [XMLMaxElementDepth <positive_integer>]] [-XMLMaxElementNameLengthCheck ( ON | OFF ) [XMLMaxElementNameLength <positive_integer>]] [-XMLMaxElementsCheck ( ON | OFF ) [-XMLMaxElements <positive_integer>]] [-XMLMaxElementChildrenCheck ( ON | OFF ) [-XMLMaxElementChildren <positive_integer>]] [-XMLMaxAttributesCheck ( ON | OFF ) [-XMLMaxAttributes <positive_integer>]] [XMLMaxAttributeNameLengthCheck ( ON | OFF ) [-XMLMaxAttributeNameLength <positive_integer>]] [XMLMaxAttributeValueLengthCheck ( ON | OFF ) [-XMLMaxAttributeValueLength <positive_integer>]] [-XMLMaxCharDATALengthCheck ( ON | OFF ) [-XMLMaxCharDATALength <positive_integer>]] [-
XMLMaxFileSizeCheck ( ON | OFF ) [-XMLMaxFileSize <positive_integer>]] [-XMLMinFileSizeCheck ( ON | OFF ) [-XMLMinFileSize <positive_integer>]] [-XMLBlockPI ( ON | OFF )] [-XMLBlockDTD ( ON | OFF )] [-XMLBlockExternalEntities ( ON | OFF )] [-XMLMaxEntityExpansionsCheck ( ON | OFF ) [-XMLMaxEntityExpansions <positive_integer>]] [-XMLMaxEntityExpansionDepthCheck ( ON | OFF ) [-XMLMaxEntityExpansionDepth <positive_integer>]] [-XMLMaxNamespacesCheck ( ON | OFF ) [-XMLMaxNamespaces <positive_integer>]] [-XMLMaxNamespaceUriLengthCheck ( ON | OFF ) [-XMLMaxNamespaceUriLength <positive_integer>]] [-XMLSOAPArrayCheck ( ON | OFF ) [XMLMaxSOAPArraySize <positive_integer>] [-XMLMaxSOAPArrayRank <positive_integer>]]) | (-XMLWSIURL <expression> [-XMLWSIChecks <string>]) | (-XMLValidationURL <expression> (-XMLRequestSchema <string> | (-XMLWSDL <string> [-XMLAdditionalSOAPHeaders ( ON | OFF )] [-XMLEndPointCheck ( ABSOLUTE | RELATIVE )]) | -XMLValidateSOAPEnvelope ( ON | OFF )) [-XMLResponseSchema <string>] [-XMLValidateResponse ( ON | OFF )]) | (-XMLAttachmentURL <expression> [-XMLMaxAttachmentSizeCheck ( ON | OFF ) [-XMLMaxAttachmentSize <positive_integer>]] [-XMLAttachmentContentTypeCheck ( ON | OFF ) [XMLAttachmentContentType <expression>]]) | (-XMLSQLInjection <string> [-isRegex ( REGEX | NOTREGEX )] [-location ( ELEMENT | ATTRIBUTE )]) | (-XMLXSS <string> [-isRegex ( REGEX | NOTREGEX )] [-location ( ELEMENT | ATTRIBUTE )])) [-comment <string>] [-state ( ENABLED | DISABLED )] Description Bind a security check to the Application Firewall profile. You can bind any number of security checks to the profile. When the profile is activated (see the add appfw global command), each security check tests the data stream for the specified condition. When a test fails, the appropriate action is determined by the action configured in the profile. Arguments name Application Firewall profile name. startURL Start URL regular expression. This binding is applicable to Profile Type: HTML, XML. denyURL Deny URL regular expression. This binding is applicable to Profile Type: HTML, XML. fieldConsistency Form field name. This binding is applicable to Profile Type: HTML. cookieConsistency Cookie name. This binding is applicable to Profile Type: HTML, XML. SQLInjection Form field, header or cookie name. This binding is applicable to Profile Type: HTML. CSRFTag CSRF Form Origin URL. This binding is applicable to Profile Type: HTML. crossSiteScripting Form field, header or cookie name. This binding is applicable to Profile Type: HTML. fieldFormat Field format name. This binding is applicable to Profile Type: HTML. safeObject Safe Object name. This binding is applicable to Profile Type: HTML, XML. comment Comments associated with this profile. state Enabled. Possible values: ENABLED, DISABLED Default value: ENABLED XMLDoSURL XML DoS URL regular expression. This binding is applicable to Profile Type: XML.
XMLWSIURL XML WS-I URL regular expression. This binding is applicable to Profile Type: XML. XMLValidationURL XML Validation URL regular expression. This binding is applicable to Profile Type: XML. XMLAttachmentURL XML Attachment URL regular expression. This binding is applicable to Profile Type: XML. XMLSQLInjection XML SQL Injection exemption field, this can be an element or an attribute name. XMLXSS XML XSS Injection exemption field, this can be an element or an attribute name. Example Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile unbind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile
unbind appfw profile

Synopsis unbind appfw profile <name> (-startURL <expression> | -denyURL <expression> | (-fieldConsistency <string> <formActionURL>) | -cookieConsistency <string> | (-SQLInjection <string> <formActionURL> [-location <location>]) | (-crossSiteScripting <string> <formActionURL> [-location <location>]) | (-fieldFormat <string> <formActionURL>) | -safeObject <string> | -XMLDoSURL <expression> | -XMLWSIURL <expression> | XMLValidationURL <expression> | -XMLAttachmentURL <expression> | (-XMLSQLInjection <string> [-location ( ELEMENT | ATTRIBUTE )]) | (-XMLXSS <string> [-location ( ELEMENT | ATTRIBUTE )])) [-CSRFTag <string> <CSRFFormActionURL>] Description Unbind a security check from the given Application Firewall profile. Arguments name Application Firewall profile name. startURL Start URL regular expression. denyURL Deny URL regular expression. fieldConsistency Form field name.
cookieConsistency Cookie name. SQLInjection Form field, header or cookie name. CSRFTag CSRF Form origin URL. This binding is applicable to Profile Type: HTML. crossSiteScripting Form field, header or cookie name. fieldFormat Field format name. safeObject Safe Object name. XMLDoSURL XML DoS URL regular expression. XMLWSIURL XML WS-I URL regular expression. XMLValidationURL XML Message URL regular expression. XMLAttachmentURL XML Attachment URL regular expression. XMLSQLInjection XML SQL Injection exemption field, this can be an element or an attribute name. XMLXSS XML XSS Injection exemption field, this can be an element or an attribute name. Example
Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile show appfw profile stat appfw profile archive appfw profile restore appfw profile
show appfw profile

Synopsis show appfw profile [<name>]
Description Display all Application Firewall profiles that currently exist. Arguments name The name of the Application Firewall profile. summary fullValues format level stateflag type The profile type of of this Application Firewall profile. If the profile is of the HTML type, only checks relevant to HTML are applied. If the profile is of the XML type, only checks relevent to XML are applied. if the profile is of the Web 2.0 type, then both types of checks are applied. useHTMLErrorObject Use HTML Error object for response instead of Redirect Error URL. errorURL The error page for this profile. HTMLErrorObject Object name for the html error page. This check is applicable to Profile Type: HTML. logEveryPolicyHit Log every profile match regardless of security checks results. stripComments Tells the Application Firewall to strip HTML comments from responses before sending them to the user. stripHtmlComments Tells the Application Firewall to strip HTML comments from responses before sending them to the user. stripXmlComments Tells the Application Firewall to strip XML comments from responses before sending them to the user. defaultCharSet The default character set. The character set that the Application Firewall uses for web pages that do not explicitly set a different character set. postBodyLimit The maximum body size for an HTTP POST. fileUploadMaxNum Maximum allowed number of file uploads per form submission request. Setting this parameter to the maximum value of 65535 will allow an unlimited number of uploads. canonicalizeHTMLResponse Tells the Application Firewall to convert any non-ASCII characters into HTML entities before sending responses to the user. This is called 'canonicalization' of HTML responses. enableFormTagging
Enables tagging of web forms for form field Consistency checks. sessionlessFieldConsistency Enable session less form field consistency checks. sessionlessURLClosure Enable session less URL closure checks. semicolonFieldSeparator Allow ';' as a form field separator in URL queries and POST form bodies. excludeFileUploadFromChecks Excludes uploaded files from all web form checks. SQLInjectionParseComments Canonicalizes SQL Comments in form fields. checkRequestHeaders Check for XSS and SQL injections in request headers. comment Comments associated with this profile. startURLAction Start URL action types. (BLOCK | LEARN | LOG | STATS | NONE) startURL A regular expression that designates a URL on the Start URL list. startURLClosure Enable Start URL closure. When enabled, this feature allows users to start their session at a designated start URL, then navigate from that start URL to any URL on a protected web site by clicking a link on another web page on that web site. Otherwise, requests to any URL that is not explicitly allowed are blocked. denyURLAction Deny URL action types. (BLOCK | LOG | STATS | NONE) denyURL A regular expression that designates a URL on the Deny URL list. RefererHeaderCheck Referer header check This check is applicable to Profile Type: HTML. CSRFtagAction Cross-site request forgery tagging action types. (BLOCK | LOG | STATS | NONE) CSRFTag The web form originating URL. CSRFFormActionURL The web form action URL. crossSiteScriptingAction Cross-site scripting action types. (BLOCK | LEARN | LOG | STATS | NONE) crossSiteScriptingTransformUnsafeHTML Enables transformation of unsafe HTML into safe HTML before forwarding a request to the web server. crossSiteScriptingCheckCompleteURLs
Tells the Application Firewall to check complete URLs rather than just the query portion of URLs for cross-site scripting violations. crossSiteScripting The web form field name. isRegex Is the web form field name a regular expression? formActionURL The web form action URL. exemptClosureURLsFromSecurityChecks Tells the Application Firewall to exempt closure URLs from security checks. location Location of cross-site scripting exception - form field, header or cookie. SQLInjectionAction SQL injection action types. (BLOCK | LEARN | LOG | STATS | NONE) SQLInjectionTransformSpecialChars Enables transformation of SQL special characters found in web forms into safe equivalents. SQLInjectionOnlyCheckFieldsWithSQLChars Tells the Application Firewall to check form fields that contain SQL special characters only, rather than all form fields, for SQL injection violations. SQLInjection The web form field name. isRegex Is the web form field name a regular expression? formActionURL The web form action URL. invalidPercentHandling Options for handling percent-encoded names and values. location Location of SQL injection exception - form field, header or cookie. fieldConsistencyAction Form Field Consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) fieldConsistency The web form field name. isRegex Is the web form field name a regular expression? formActionURL The web form action URL. cookieConsistencyAction Cookie consistency action types. (BLOCK | LEARN | LOG | STATS | NONE) cookieConsistency The name of the cookie to be checked. isRegex Is the cookie name a regular expression?
cookieTransforms Enable cookie transforms: encryption, proxying, and adding cookie flags. Make sure this is turned ON if you want the transforms to happen. This check is applicable to Profile Type: HTML. XML cookieEncryption Encrypts server cookies cookieProxying Proxies server cookies using the Application Firewall session addCookieFlags Add HttpOnly and/or Secure flags to cookies bufferOverflowAction Buffer overflow action types. (BLOCK | LOG | STATS | NONE) bufferOverflowMaxURLLength Maximum allowed length for URLs. bufferOverflowMaxHeaderLength Maximum allowed length for HTTP headers. bufferOverflowMaxCookieLength Maximum allowed length for cookies. fieldFormatAction Field format action types. (BLOCK | LEARN | LOG | STATS | NONE) defaultFieldFormatType Name of the default field type, the field type that the Application Firewall will assign to a form field when no specific field type is assigned to that particular form field. defaultFieldFormatMinLength Default field type minimum length setting. defaultFieldFormatMaxLength Default field type maximum length setting. fieldFormat Name of the form field to which a field format will be assigned. isRegex Is the form field name a regular expression? formActionURL Action URL of the form field to which a field format will be assigned. fieldType The field type you are assigning to this form field. fieldFormatMinLength The minimum allowed length for data in this form field. fieldFormatMaxLength The maximum allowed length for data in this form field. creditCardAction Credit Card action types. (BLOCK | LOG | STATS | NONE) creditCard Credit card types. (AMEX | DINERSCLUB| DISCOVER | JBC | MASTERCARD | VISA) creditCardMaxAllowed
Maximum number of times a credit card number may be seen before action is taken. creditCardXOut X-out credit card numbers. safeObject Name of the Safe Object. expression A regular expression that defines the Safe Object. maxMatchLength Maximum match length for a Safe Object expression. action Safe Object action types. (BLOCK | LOG | STATS | NONE) requestContentType Default content-type for request messages. responseContentType Default content-type for response messages. XMLErrorObject URL for the xml error page signatures Signatures for the profile XMLFormatAction XML well-formed request action types. (BLOCK | LOG | STATS | NONE) XMLDoSAction XML DOS action types. (BLOCK | LEARN | LOG | STATS | NONE) XMLSQLInjectionAction XML SQL Injection action types. (BLOCK | LOG | STATS | NONE) XMLSQLInjectionOnlyCheckFieldsWithSQLChars XML flag to check only fields with SQL characters. XMLSQLInjectionParseComments Canonicalize SQL Comments in XML data. XMLXSSAction XML cross-site scripting action types. (BLOCK | LOG | STATS | NONE) XMLWSIAction XML WSI action types. (BLOCK | LEARN | LOG | STATS | NONE) XMLAttachmentAction XML attachment action types. (BLOCK | LEARN | LOG | STATS | NONE) XMLValidationAction XML message validation action types. (BLOCK | LOG | STATS | NONE) XMLSOAPFaultAction XML SOAP fault filtering action types. (BLOCK | LOG | STATS | REMOVE | NONE) XMLDoSURL XML DoS URL regular expression length. XMLWSIURL
XML WS-I URL regular expression length. XMLValidationURL XML Validation URL regular expression. XMLAttachmentURL XML attachment URL regular expression length. XMLSQLInjection XML SQL Injection exemption field, this can be an element or an attribute name. isRegex Is the XML SQL Injection exempted field name a regular expression? location Location of SQL injection exception - XML Element or Attribute. XMLXSS XML XSS Injection exemption field, this can be an element or an attribute name. isRegex Is the XML XSS exempted field name a regular expression? location Location of XSS injection exception - XML Element or Attribute. state Enabled. XMLMaxElementDepthCheck State if XML Max element depth check is ON or OFF. XMLMaxElementDepth Maximum nesting (depth) of XML elements. This check protects against documents that have excessive hierarchy depths. XMLMaxElementNameLengthCheck State if XML Max element name length check is ON or OFF. XMLMaxElementNameLength Specify the longest name of any element (including the expanded namespace) to protect against overflow attacks. XMLMaxElementsCheck State if XML Max elements check is ON or OFF. XMLMaxElements Specify the maximum number of XML elements allowed. Protects against overflow attacks. XMLMaxElementChildrenCheck State if XML Max element children check is ON or OFF. XMLMaxElementChildren Specify the maximum number of children allowed per XML element. Protects against overflow attacks. XMLMaxNodesCheck State if XML Max nodes check is ON or OFF. XMLMaxNodes Specify the maximum number of XML nodes. Protects against overflow attacks. XMLMaxAttributesCheck
State if XML Max attributes check is ON or OFF. XMLMaxAttributes Specify maximum number of attributes per XML element. Protects against overflow attacks. XMLMaxAttributeNameLengthCheck State if XML Max attribute name length check is ON or OFF. XMLMaxAttributeNameLength Specify the longest name of any XML attribute. Protects against overflow attacks. XMLMaxAttributeValueLengthCheck State if XML Max atribute value length is ON or OFF. XMLMaxAttributeValueLength Specify the longest value of any XML attribute. Protects against overflow attacks. XMLMaxCharDATALengthCheck State if XML Max CDATA length check is ON or OFF. XMLMaxCharDATALength Specify the maximum size of CDATA. Protects against overflow attacks and large quantities of unparsed data within XML messages. XMLMaxFileSizeCheck State if XML Max file size check is ON or OFF. XMLMaxFileSize Specify the maximum size of XML messages. Protects against overflow attacks. XMLMinFileSizeCheck State if XML Min file size check is ON or OFF. XMLMinFileSize Enforces minimum message size. XMLBlockPI State if XML Block PI is ON or OFF. Protects resources from denial of service attacks as SOAP messages cannot have processing instructions (PI) in messages. XMLBlockDTD State if XML DTD is ON or OFF. Protects against recursive Document Type Declaration (DTD) entity expansion attacks. Also, SOAP messages cannot have DTDs in messages. XMLBlockExternalEntities State if XML Block External Entities Check is ON or OFF. Protects against XML External Entity (XXE) attacks that force applications to parse untrusted external entities (sources) in XML documents. XMLMaxEntityExpansionsCheck State if XML Max Entity Expansions Check is ON or OFF. XMLMaxEntityExpansions Specify maximum allowed number of entity expansions. Protects aganist Entity Expansion Attack. XMLMaxEntityExpansionDepthCheck State if XML Max Entity Expansions Depth Check is ON or OFF. XMLMaxEntityExpansionDepth Specify maximum entity expansion depth. Protects aganist Entity Expansion Attack. XMLMaxNamespacesCheck
State if XML Max namespaces check is ON or OFF. XMLMaxNamespaces Specify maximum number of active namespaces. Protects against overflow attacks. XMLMaxNamespaceUriLengthCheck State if XML Max namespace URI length check is ON or OFF. XMLMaxNamespaceUriLength Specify the longest URI of any XML namespace. Protects against overflow attacks. XMLSOAPArrayCheck State if XML SOAP Array check is ON or OFF. XMLMaxSOAPArraySize XML Max Total SOAP Array Size. Protects against SOAP Array Abuse attack. XMLMaxSOAPArrayRank XML Max Individual SOAP Array Rank. This is the dimension of the SOAP array. XMLWSIChecks Specify a comma separated list of relevant WS-I rule IDs. (R1140, R1141) XMLRequestSchema XML Schema object for request validation . XMLResponseSchema XML Schema object for response validation. XMLWSDL WSDL object for soap request validation. XMLAdditionalSOAPHeaders Allow addtional soap headers. XMLEndPointCheck Modifies the behaviour of the Request URL validation w.r.t. the Service URL. If set to ABSOLUTE, the entire request URL is validated with the entire URL mentioned in Service of the associated WSDL. eg: Service URL: http://example.org/ExampleService, Request URL: http//example.com/ExampleService would FAIL the validation. If set to RELAIVE, only the non-hostname part of the request URL is validated against the non-hostname part of the Service URL. eg: Service URL: http://example.org/ExampleService, Request URL: http//example.com/ ExampleService would PASS the validation. XMLValidateSOAPEnvelope Validate SOAP Evelope only. XMLValidateResponse Validate response message. XMLMaxAttachmentSizeCheck State if XML Max attachment size Check is ON or OFF. Protects against XML requests with large attachment data. XMLMaxAttachmentSize Specify maximum attachment size. XMLAttachmentContentTypeCheck State if XML attachment content-type check is ON or OFF. Protects against XML requests with illegal attachments. XMLAttachmentContentType
Specify content-type regular expression. builtin Indicates that a profile is a built-in entity. builtinType Type of built-in profiles count Example Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile stat appfw profile archive appfw profile restore appfw profile
stat appfw profile

Synopsis stat appfw profile [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display appfw profile statistics. Arguments name Application Firewall profile name. count devno stateflag requests (reqs) HTTP/HTTPS requests sent to your protected web servers via the Application Firewall. Request Bytes (reqBytes) Number of bytes transfered for requests responses (resps) HTTP/HTTPS responses sent by your protected web servers via the Application Firewall. Response Bytes (resBytes) Number of bytes transfered for responses aborts Incomplete HTTP/HTTPS requests aborted by the client before the Application Firewall could finish processing them.
redirects (redirect) HTTP/HTTPS requests redirected by the Application Firewall to a different Web page or web server. (HTTP 302) Long Term Ave Response Time (ms) (longAvgRespTimePP) Average backend response time in milliseconds since reboot Recent Ave Response Time (ms) (shortAvgRespTimePP) Average backend response time in milliseconds over the last 7 seconds start URL (startURL) Number of Start URL security check violations seen by the Application Firewall. deny URL (denyURL) Number of Deny URL security check violations seen by the Application Firewall. referer header (refererHdr) Number of Referer Header security check violations seen by the Application Firewall. buffer overflow (bufovfl) Number of Buffer Overflow security check violations seen by the Application Firewall. cookie consistency (cookie) Number of Cookie Consistency security check violations seen by the Application Firewall. CSRF form tag (csrf_tag) Number of Cross Site Request Forgery form tag security check violations seen by the Application Firewall. HTML Cross-site scripting (xss) Number of HTML Cross-Site Scripting security check violations seen by the Application Firewall. HTML SQL injection (sql) Number of HTML SQL Injection security check violations seen by the Application Firewall. field format (fieldfmt) Number of Field Format security check violations seen by the Application Firewall. field consistency (fieldcon) Number of Field Consistency security check violations seen by the Application Firewall. credit card (ccard) Number of Credit Card security check violations seen by the Application Firewall. safe object (safeobj) Number of Safe Object security check violations seen by the Application Firewall. Signature Violations (sigs) Number of Signature violations seen by the Application Firewall. XML Format (wfcViolations) Number of XML Format security check violations seen by the Application Firewall. XML Denial of Service (XDoS) (xdosViolations) Number of XML Denial-of-Service security check violations seen by the Application Firewall. XML Message Validation (msgvalViolations) Number of XML Message Validation security check violations seen by the Application Firewall. Web Services Interoperability (wsIViolations) Number of Web Services Interoperability (WS-I) security check violations seen by the Application Firewall.
XML SQL Injection (xmlSqlViolations) Number of XML SQL Injection security check violations seen by the Application Firewall. XML Cross-Site Scripting (xmlXssViolations) Number of XML Cross-Site Scripting (XSS) security check violations seen by the Application Firewall. XML Attachment (xmlAttachmentViolations) Number of XML Attachment security check violations seen by the Application Firewall. SOAP Fault Violations (soapflt) Number of requests returning soap:fault from the backend server XML Generic Violations (genflt) Number of requests returning XML generic violation from the backend server Total Violations (totperpr) Number of violations seen by the application firewall on per profile basis HTTP Client Errors (4xx Resp) (4xxResps) Number of requests returning HTTP 4xx from the backend server HTTP Server Errors (5xx Resp) (5xxResps) Number of requests returning HTTP 5xx from the backend server Example stat appfw profile
Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile archive appfw profile restore appfw profile stat appfw stat appfw policy stat appfw policylabel
archive appfw profile

Synopsis archive appfw profile <name> <archivename> Description Create archive for the profile.
Arguments name Application Firewall profile name. archivename Specify source for tar archive. Example
Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile restore appfw profile
restore appfw profile

Synopsis restore appfw profile <archivename> Description Restore configuration from archive file Arguments archivename Specify source for tar archive. Example
Related Commands add appfw profile rm appfw profile set appfw profile unset appfw profile bind appfw profile unbind appfw profile show appfw profile stat appfw profile
archive appfw profile
add appfw policy

Synopsis add appfw policy <name> <rule> <profileName> [-comment <string>] [-logAction <string>] Description Create an Application Firewall policy. Arguments name Application Firewall policy name. rule The rule associated with the policy. profileName Application Firewall profile name. comment Comments associated with this application firewall policy. logAction The log action associated with the application firewall policy Example
Related Commands rm appfw policy set appfw policy unset appfw policy show appfw policy stat appfw policy rename appfw policy
rm appfw policy
Synopsis rm appfw policy <name> Description Remove an Application Firewall policy. Arguments name Application Firewall policy name. Example
Related Commands add appfw policy set appfw policy unset appfw policy show appfw policy stat appfw policy rename appfw policy
set appfw policy

Synopsis set appfw policy <name> [-rule <expression>] [-profileName <string>] [-comment <string>] [-logAction <string>] Description Modify an Application Firewall policy. Set a new rule/profile/comment for existing application firewall policy. Arguments name Application Firewall policy name. rule The rule associated with the policy. profileName Application Firewall profile name. comment Comments associated with this application firewall policy. logAction The log action associated with the application firewall policy Example set transform policy pol9 -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh2\\")"
Related Commands add appfw policy rm appfw policy unset appfw policy show appfw policy stat appfw policy rename appfw policy
unset appfw policy

Synopsis unset appfw policy <name> [-comment] [-logAction]
Description Unset comment/logaction for existing transform policy..Refer to the set appfw policy command for meanings of the arguments. Arguments Example unset transform policy pol9 -undefAction
Related Commands add appfw policy rm appfw policy set appfw policy show appfw policy stat appfw policy rename appfw policy
show appfw policy

Synopsis show appfw policy [<name>] Description Display the Application Firewall policies. Arguments name Application Firewall policy name. summary fullValues format level stateflag rule The rule associated with the policy. profileName Application Firewall profile name. hits Number of hits. piHits Number of hits. undefHits
Number of Undef hits. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. comment Comments associated with this application firewall policy. logAction The log action associated with the application firewall policy boundTo The entity name to which policy is bound activePolicy Indicates whether policy is bound or not. priority Specifies the priority of the policy. bindPolicyType policyType vserverType policyType count Example
Related Commands add appfw policy rm appfw policy set appfw policy unset appfw policy stat appfw policy rename appfw policy
stat appfw policy

Synopsis stat appfw policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display advance application firewall policy statistics.
Arguments name The name of the advance application firewall policy for which statistics will be displayed. If not given statistics are shown for all advance application firewall policies. count devno stateflag Policy hits (Hits) Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example stat appfw policy
Related Commands add appfw policy rm appfw policy set appfw policy unset appfw policy show appfw policy rename appfw policy stat appfw stat appfw profile stat appfw policylabel
rename appfw policy

Synopsis rename appfw policy <name>@ <newName>@ Description Rename a application firewall policy. Arguments name The name of the application firewall policy. newName The new name of the application firewall policy. Example rename appfw policy oldname newname
Related Commands add appfw policy rm appfw policy set appfw policy unset appfw policy show appfw policy stat appfw policy
add appfw policylabel

Synopsis add appfw policylabel <labelName> <policylabeltype> Description Add a application firewall policy label. Arguments labelName Name of the application firewall policy label. policylabeltype The type of transformations allowed by the policies bound to the label. Possible values: http_req Example add appfw policylabel appfw_label http_req
Related Commands rm appfw policylabel bind appfw policylabel unbind appfw policylabel show appfw policylabel stat appfw policylabel rename appfw policylabel
rm appfw policylabel
Synopsis rm appfw policylabel <labelName> Description Remove a application firewall policy label. Arguments labelName Name of the application firewall policy label.
Example rm appfw policylabel appfw_label
Related Commands add appfw policylabel bind appfw policylabel unbind appfw policylabel show appfw policylabel stat appfw policylabel rename appfw policylabel
bind appfw policylabel

Synopsis bind appfw policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the application firewall policy to one of the labels. Arguments labelName Name of the application firewall policy label. policyName The transform policy name. Example i) bind appfw policylabel trans_http_url pol_1 1 2 -invoke reqvserver CURRENT ii) bind appfw policylabel trans_http_url pol_2 2
Related Commands add appfw policylabel rm appfw policylabel unbind appfw policylabel show appfw policylabel stat appfw policylabel rename appfw policylabel
unbind appfw policylabel

Synopsis unbind appfw policylabel <labelName> <policyName> [-priority <positive_integer>]
Description Unbind entities from application firewall label. Arguments labelName Name of the application firewall policy label. policyName The transform policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind appfw policylabel appfw_label
Related Commands add appfw policylabel rm appfw policylabel bind appfw policylabel show appfw policylabel stat appfw policylabel rename appfw policylabel
show appfw policylabel

Synopsis show appfw policylabel [<labelName>] Description Display policy label or policies bound to application firewall policylabel. Arguments labelName Name of the application firewall policy label. summary fullValues format level stateflag policylabeltype The type of transformations allowed by the policies bound to the label. numpol Number of polices bound to label. hits
Number of times policy label was invoked. policyName The transform policy name. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policylabel flags policyType count Example i) show appfw policylabel appfw_label ii) show appfw policylabel
Related Commands add appfw policylabel rm appfw policylabel bind appfw policylabel unbind appfw policylabel stat appfw policylabel rename appfw policylabel
stat appfw policylabel

Synopsis stat appfw policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of application firewall policylabel(s). Arguments labelName The name of the application firewall label for which statistics will be displayed. If not given statistics are shown for all application firewall policylabels. count
devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add appfw policylabel rm appfw policylabel bind appfw policylabel unbind appfw policylabel show appfw policylabel rename appfw policylabel stat appfw stat appfw profile stat appfw policy
rename appfw policylabel

Synopsis rename appfw policylabel <labelName>@ <newName>@ Description Rename a application firewall policy label. Arguments labelName The name of the application firewall policy label. newName The new name of the application firewall policylabel. Example rename appfw policylabel oldname newname
Related Commands add appfw policylabel rm appfw policylabel bind appfw policylabel unbind appfw policylabel show appfw policylabel stat appfw policylabel
add appfw confidField

Synopsis add appfw confidField <fieldName> <url> [-isRegex ( REGEX | NOTREGEX )] [-comment <string>] [-state ( ENABLED | DISABLED )] Description Define a form field (identified by the action URL and the field name) as confidential. These fields will have their values X'ed out in the audit logs. Arguments fieldName Form field name. url Form action URL. isRegex Is field name a regular expression? Possible values: REGEX, NOTREGEX Default value: NS_NOTREGEX comment Comments associated with this confidential form field. state Enabled. Possible values: ENABLED, DISABLED Default value: ENABLED Example
Related Commands rm appfw confidField set appfw confidField unset appfw confidField show appfw confidField
rm appfw confidField
Synopsis rm appfw confidField <fieldName> <url> Description Remove a confidential field. The field values will be logged as-is in the audit logs. Arguments fieldName Form field name. url Form action URL.
Example
Related Commands add appfw confidField set appfw confidField unset appfw confidField show appfw confidField
set appfw confidField

Synopsis set appfw confidField <fieldName> <url> [-comment <string>] [-state ( ENABLED | DISABLED )] Description Modify a confidential field setting. Confidential fields have their values X'ed out in the audit logs Arguments fieldName Form field name. url Form action URL. comment Comments associated with this confidential form field. state Enabled. Possible values: ENABLED, DISABLED Default value: ENABLED Example
Related Commands add appfw confidField rm appfw confidField unset appfw confidField show appfw confidField
unset appfw confidField

Synopsis unset appfw confidField <fieldName> <url> [-comment] [-state] Description Use this command to remove appfw confidField settings.Refer to the set appfw confidField command for meanings of the arguments.
Arguments Example
Related Commands add appfw confidField rm appfw confidField set appfw confidField show appfw confidField
show appfw confidField

Synopsis show appfw confidField [<fieldName> <url>] Description Display all configured confidential form fields. Arguments fieldName Form field name. url Form action URL. summary fullValues format level isRegex Is field name a regular expression? comment Comments associated with this confidential form field. state Enabled. count stateflag Example
Related Commands add appfw confidField rm appfw confidField set appfw confidField
unset appfw confidField
show appfw stats

Synopsis show appfw stats - alias for 'stat appfw' Description show appfw stats is an alias for stat appfw Arguments Example
Related Commands stat appfw
rm appfw customSettings
Synopsis Description Removes the object imported by import customsettings. NOTE: This command is deprecated.Changed CLI commands for Appfw "customSettings" to "signatures" Arguments name Indicates name of custom-settings object. Example rm customsettings <name> Related Commands show appfw customSettings import appfw customSettings update appfw customSettings
show appfw customSettings

Synopsis Description Displays the object imported by import customsettings. NOTE: This command is deprecated.Changed CLI commands for Appfw "customSettings" to "signatures" Arguments name
response Example show appfw customsettings
Related Commands rm appfw customSettings import appfw customSettings update appfw customSettings
import appfw customSettings

Synopsis
Description Downloads the Application Firewall Custom Settings XML configuration to the NetScaler Box with the given object name NOTE: This command is deprecated.Changed CLI commands for Appfw "customSettings" to "signatures" Arguments src Indicates the source of the custom settings file as a URL of the form <protocol>://<host>[:<port>] [/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication. name Indicates name of custom-settings object. comment Comments. overwrite Overwrites the existing file Example import customsettings http://www.example.com/ns/customsettings.xml my-settings
Related Commands rm appfw customSettings show appfw customSettings update appfw customSettings
update appfw customSettings

Synopsis
Description Updates the Application Firewall Custom Settings XML configuration to the NetScaler Box with the given object name NOTE: This command is deprecated.Changed CLI commands for Appfw "customSettings" to "signatures" Arguments name Indicates name of the custom-settings object to update. Example update customsettings my-settings
Related Commands rm appfw customSettings show appfw customSettings import appfw customSettings
rm appfw xmlerrorpage
Synopsis rm appfw xmlerrorpage <name> Description Removes the object imported by import xmlerrorpage. Arguments name Indicates name of the imported xml error page to be removed. Example rm xmlerrorpage <name>
Related Commands show appfw xmlerrorpage import appfw xmlerrorpage update appfw xmlerrorpage
show appfw xmlerrorpage

Synopsis show appfw xmlerrorpage [<name>] Description Displays the object imported by import xmlerrorpage. Arguments name
response Example show appfw xmlerrorpage
Related Commands rm appfw xmlerrorpage import appfw xmlerrorpage update appfw xmlerrorpage
import appfw xmlerrorpage

Synopsis import appfw xmlerrorpage <src> <name> [-comment <string>] [-overwrite] Description Downloads the input XML Error Page to NetScaler Box with the given object name Arguments src Indicates the source of the XML error page as a URL of the form <protocol>://<host>[:<port>] [/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication. name Indicates name of the xml error page to import. comment Comments. overwrite Overwrites the existing file Example import xmlerrorpage http://www.example.com/errorpage.xml my-xml-error-page
Related Commands rm appfw xmlerrorpage show appfw xmlerrorpage update appfw xmlerrorpage
update appfw xmlerrorpage

Synopsis update appfw xmlerrorpage <name>
Description Reloads the XML error page of the given object name in appfw profiles Arguments name Indicates name of the xml error page to update. Example update xmlerrorpage my-xml-error-page Related Commands rm appfw xmlerrorpage show appfw xmlerrorpage import appfw xmlerrorpage
rm appfw htmlerrorpage
Synopsis rm appfw htmlerrorpage <name> Description Removes the object imported by import htmlerrorpage. Arguments name Indicates name of the imported html error page to be removed. Example rm htmlerrorpage <name> Related Commands show appfw htmlerrorpage import appfw htmlerrorpage update appfw htmlerrorpage
show appfw htmlerrorpage

Synopsis show appfw htmlerrorpage [<name>] Description Displays the object imported by import htmlerrorpage. Arguments name response
Example show appfw htmlerrorpage Related Commands rm appfw htmlerrorpage import appfw htmlerrorpage update appfw htmlerrorpage
import appfw htmlerrorpage

Synopsis import appfw htmlerrorpage <src> <name> [-comment <string>] [-overwrite] Description Downloads the input HTML Error Page to NetScaler Box with the given object name Arguments src Indicates the source of the HTML error page as a URL of the form <protocol>://<host>[:<port>] [/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication. name Indicates name of the html error page to import. comment Comments. overwrite Overwrites the existing file Example import htmlerrorpage http://www.example.com/errorpage.html my-html-error-page Related Commands rm appfw htmlerrorpage show appfw htmlerrorpage update appfw htmlerrorpage
update appfw htmlerrorpage

Synopsis update appfw htmlerrorpage <name> Description Reloads the HTML error page of the given object name in appfw profiles
Arguments name Indicates name of the html error page to update. Example update htmlerrorpage my-html-error-page
Related Commands rm appfw htmlerrorpage show appfw htmlerrorpage import appfw htmlerrorpage
set appfw settings

Synopsis set appfw settings [-defaultProfile <string>] [-undefAction <string>] [-sessionTimeout <positive_integer>] [-learnRateLimit <positive_integer>] [-sessionLifetime <positive_integer>] [-sessionCookieName <string>] [-clientIPLoggingHeader <string>] [-importSizeLimit <positive_integer>] [-cookiePostEncryptPrefix <string>] [-logMalformedReq ( ON | OFF )] [-CEFLogging ( ON | OFF )] [-entityDecoding ( ON | OFF )] [useConfigurableSecretKey ( ON | OFF )] Description Set the global settings for the Application Firewall module. Changes in these settings are applied to all Application Firewall profiles. Arguments defaultProfile Application Firewall global default profile. Default value: AS_ENGINESETTINGS_DEFAULT_PROF_DEFAULT undefAction Application Firewall global undefined profile. Default value: AS_ENGINESETTINGS_UNDEF_PROF_DEFAULT sessionTimeout The user session timeout (in seconds). After this many seconds of no user activity, the session is terminated and the user must establish a new session before continuing to use the protected web site. Default value: AS_ENGINESETTINGS_SESSIONTIMEOUT_DEFAULT Minimum value: 1 Maximum value: 65535 learnRateLimit The AppFw learn messages rate limit value (in messages per second). The extra learn messages are dropped when the rate goes above this value. Default value: AS_ENGINESETTINGS_LEARN_RATE_LIMIT_DEFAULT Minimum value: 1 Maximum value: 1000 sessionLifetime The user session lifetime (in seconds). If a session has existed more than the specified number of seconds, the session can be terminated and the user must establish a new session before continuing to use the protected web site. Default value: AS_ENGINESETTINGS_SESSIONLIFETIME_DEFAULT Maximum value: 2147483647 sessionCookieName
The name of the session cookie set by the Application Firewall to track the user session. Default value: NS_S_AS_DEFAULT_COOKIE_NAME clientIPLoggingHeader The name of the header that holds downstream IP address for logging purposes. importSizeLimit Total import size limit. Default value: AS_ENGINESETTINGS_IMPORTSIZELIMIT_DEFAULT Minimum value: 1 Maximum value: 134217728 cookiePostEncryptPrefix String which is prepended to all encrypted cookie values Default value: NS_S_AS_DEFAULT_CKI_POST_ENCRYPT_PREFIX logMalformedReq Log requests that are so malformed that AppFw parsing doesn't happen Possible values: ON, OFF CEFLogging Enable CEF formatted logging. Possible values: ON, OFF entityDecoding Decode Entity-Encoded characters before doing AppFw checks. Possible values: ON, OFF Default value: OFF useConfigurableSecretKey Use configurable secret key in AppFw operations Possible values: ON, OFF Default value: OFF Example
Related Commands unset appfw settings show appfw settings
unset appfw settings

Synopsis unset appfw settings [-defaultProfile] [-undefAction] [-sessionTimeout] [-learnRateLimit] [-sessionLifetime] [sessionCookieName] [-clientIPLoggingHeader] [-importSizeLimit] [-cookiePostEncryptPrefix] [-logMalformedReq] [-CEFLogging] [-entityDecoding] [-useConfigurableSecretKey] Description Use this command to remove appfw settings settings.Refer to the set appfw settings command for meanings of the arguments. Arguments Example
Related Commands set appfw settings show appfw settings
show appfw settings

Synopsis show appfw settings Description Display the global settings for the Application Firewall module. Arguments format level defaultProfile Application Firewall global default profile. undefAction Application Firewall global undefined profile. sessionTimeout Session timeout (in seconds). learnRateLimit Learn messages rate limit value (in messages per second). sessionLifetime Session lifetime (in seconds). Zero means no limit. sessionCookieName The name of the session cookie set by the Application Firewall to track the user session. clientIPLoggingHeader Name of header that holds downstream IP address for logging purposes. importSizeLimit Total import size limit. cookiePostEncryptPrefix String which is prepended to all encrypted cookie values logMalformedReq Log requests that are so malformed that AppFw parsing doesn't happen CEFLogging Enable CEF formatted logging. entityDecoding Decode Entity-Encoded characters before doing AppFw checks. useConfigurableSecretKey Use configurable secret key in AppFw operations Example
Related Commands set appfw settings
unset appfw settings
bind appfw global

Synopsis bind appfw global <policyName> <priority> [-state ( ENABLED | DISABLED )] [<gotoPriorityExpression>] [-type ( REQ_OVERRIDE | REQ_DEFAULT )] [-invoke (<labelType> <labelName>) ] Description Activate an Application Firewall policy. Arguments policyName Application Firewall policy name. Example
Related Commands unbind appfw global show appfw global
unbind appfw global

Synopsis unbind appfw global <policyName> [-type ( REQ_OVERRIDE | REQ_DEFAULT )] [-priority <positive_integer>] Description Deactivate an Application Firewall policy. Arguments policyName Application Firewall policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example
Related Commands bind appfw global show appfw global
show appfw global

Synopsis show appfw global [-type ( REQ_OVERRIDE | REQ_DEFAULT )]
Description Display the active Application Firewall policies. Arguments type The bindpoint to which to policy is bound. This can be used with advance application firewall policy only. Possible values: REQ_OVERRIDE, REQ_DEFAULT summary fullValues format level policyName Application Firewall policy name. priority The priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. state The current state of the binding. bindPolicyType The type of the policy. policySubType stateflag stateflag labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType flowtype of the bound application firewall policy. numpol The number of policies bound to the bindpoint. flags policyType count Example
Related Commands bind appfw global unbind appfw global
set appfw learningsettings

Synopsis set appfw learningsettings <profileName> [-startURLMinThreshold <positive_integer>] [-startURLPercentThreshold <positive_integer>] [-cookieConsistencyMinThreshold <positive_integer>] [-cookieConsistencyPercentThreshold <positive_integer>] [-CSRFtagMinThreshold <positive_integer>] [-CSRFtagPercentThreshold <positive_integer>] [-fieldConsistencyMinThreshold <positive_integer>] [-fieldConsistencyPercentThreshold <positive_integer>] [crossSiteScriptingMinThreshold <positive_integer>] [-crossSiteScriptingPercentThreshold <positive_integer>] [-SQLInjectionMinThreshold <positive_integer>] [-SQLInjectionPercentThreshold <positive_integer>] [-fieldFormatMinThreshold <positive_integer>] [-fieldFormatPercentThreshold <positive_integer>] [-XMLWSIMinThreshold <positive_integer>] [-XMLWSIPercentThreshold <positive_integer>] [XMLAttachmentMinThreshold <positive_integer>] [-XMLAttachmentPercentThreshold <positive_integer>] Description Set the Application Firewall learning settings. Arguments profileName Application Firewall profile name. startURLMinThreshold Minimum threshold to learn Start URLs. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 startURLPercentThreshold Minimum threshold (in percent) to learn Start URLs. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 cookieConsistencyMinThreshold Minimum threshold to learn cookie consistency information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 cookieConsistencyPercentThreshold Minimum threshold (in percent) to learn cookie consistency information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 CSRFtagMinThreshold Minimum threshold to learn CSRF tag information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 CSRFtagPercentThreshold Minimum threshold (in percent) to learn CSRF tag information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 fieldConsistencyMinThreshold Minimum threshold to learn field consistency information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 fieldConsistencyPercentThreshold Minimum threshold (in percent) to learn field consistency information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 crossSiteScriptingMinThreshold Minimum threshold to learn cross-site scripting information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 crossSiteScriptingPercentThreshold
Minimum threshold (in percent) to learn cross-site scripting information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 SQLInjectionMinThreshold Minimum threshold to learn SQL injection information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 SQLInjectionPercentThreshold Minimum threshold (in percent) to learn SQL injection information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 fieldFormatMinThreshold Minimum threshold to learn field format information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 fieldFormatPercentThreshold Minimum threshold (in percent) to learn field format information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 XMLWSIMinThreshold Minimum threshold to learn XML Web Services Interoperability information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 XMLWSIPercentThreshold Minimum threshold (in percent) to learn XML Web Services Interoperability information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 XMLAttachmentMinThreshold Minimum threshold to learn XML Attachment information. Default value: AS_LEARNINGSETTINGS_DEFAULT_MINTHRESHOLD Minimum value: 1 XMLAttachmentPercentThreshold Minimum threshold (in percent) to learn XML Attachment information. Default value: AS_LEARNINGSETTINGS_DEFAULT_PERCENTTHRESHOLD Maximum value: 100 Example
Related Commands unset appfw learningsettings show appfw learningsettings
unset appfw learningsettings

Synopsis unset appfw learningsettings <profileName> [-startURLMinThreshold] [-startURLPercentThreshold] [cookieConsistencyMinThreshold] [-cookieConsistencyPercentThreshold] [-CSRFtagMinThreshold] [CSRFtagPercentThreshold] [-fieldConsistencyMinThreshold] [-fieldConsistencyPercentThreshold] [crossSiteScriptingMinThreshold] [-crossSiteScriptingPercentThreshold] [-SQLInjectionMinThreshold] [-SQLInjectionPercentThreshold] [-fieldFormatMinThreshold] [-fieldFormatPercentThreshold] [-XMLWSIMinThreshold] [-XMLWSIPercentThreshold] [-XMLAttachmentMinThreshold] [XMLAttachmentPercentThreshold] Description Use this command to remove appfw learningsettings settings.Refer to the set appfw learningsettings command for meanings of the arguments.
Arguments Example
Related Commands set appfw learningsettings show appfw learningsettings
show appfw learningsettings

Synopsis show appfw learningsettings [<profileName>] Description Display the Application Firewall learning settings. Arguments profileName Application Firewall profile name. summary fullValues format level startURLMinThreshold Minimum threshold to learn Start URLs. startURLPercentThreshold Minimum threshold (in percent) to learn Start URLs. cookieConsistencyMinThreshold Minimum threshold to learn cookie consistency information. cookieConsistencyPercentThreshold Minimum threshold (in percent) to learn cookie consistency information. CSRFtagMinThreshold Minimum threshold to learn CSRF tag information. CSRFtagPercentThreshold Minimum threshold (in percent) to learn CSRF tag information. fieldConsistencyMinThreshold Minimum threshold to learn field consistency information. fieldConsistencyPercentThreshold Minimum threshold (in percent) to learn field consistency information. crossSiteScriptingMinThreshold Minimum threshold to learn cross-site scripting information. crossSiteScriptingPercentThreshold Minimum threshold (in percent) to learn cross-site scripting information.
SQLInjectionMinThreshold Minimum threshold to learn SQL injection information. SQLInjectionPercentThreshold Minimum threshold (in percent) to learn SQL injection information. fieldFormatMinThreshold Minimum threshold to learn field format information. fieldFormatPercentThreshold Minimum threshold (in percent) to learn field format information. XMLWSIMinThreshold Minimum threshold to learn XML Web Services Interoperability. XMLWSIPercentThreshold Minimum threshold (in percent) to learn XML Web Services Interoperability. XMLAttachmentMinThreshold Minimum threshold to learn XML Attachments. XMLAttachmentPercentThreshold Minimum threshold (in percent) to learn XML Attachments. count stateflag Example
Related Commands set appfw learningsettings unset appfw learningsettings
rm appfw learningdata
Synopsis rm appfw learningdata <profileName> (-startURL <expression> | -cookieConsistency <string> | (fieldConsistency <string> <formActionURL>) | (-crossSiteScripting <string> <formActionURL>) | (SQLInjection <string> <formActionURL>) | (-fieldFormat <string> <formActionURL>) | (-CSRFTag <expression> <CSRFFormOriginURL>) | -XMLDoSCheck <expression> | -XMLWSICheck <expression> | XMLAttachmentCheck <expression>) [-TotalXMLRequests] Description Remove some raw Application Firewall learning data. Arguments profileName Application Firewall profile name. startURL Start URL configuration. cookieConsistency Cookie Name.
fieldConsistency Form field name. crossSiteScripting Cross-site scripting. SQLInjection Form field name. fieldFormat Field format name. CSRFTag CSRF Form Action URL XMLDoSCheck XML Denial of Service check, one of MaxAttributes MaxAttributeNameLength MaxAttributeValueLength MaxElementNameLength MaxFileSize MinFileSize MaxCDATALength MaxElements MaxElementDepth MaxElementChildren NumDTDs NumProcessingInstructions NumExternalEntities MaxEntityExpansions MaxEntityExpansionDepth MaxNamespaces MaxNamespaceUriLength MaxSOAPArraySize MaxSOAPArrayRank XMLWSICheck Web Services Interoperability Rule ID. XMLAttachmentCheck XML Attachment Content-Type. TotalXMLRequests Total XML requests. Example
Related Commands show appfw learningdata reset appfw learningdata export appfw learningdata
show appfw learningdata

Synopsis show appfw learningdata <profileName> <securityCheck> Description Display the raw Application Firewall learning data. Arguments profileName Application Firewall profile name. securityCheck Security check. Possible values: startURL, cookieConsistency, fieldConsistency, crossSiteScripting, SQLInjection, fieldFormat, CSRFtag, XMLDoSCheck, XMLWSICheck, XMLAttachmentCheck, TotalXMLRequests
summary fullValues data Learned data. count stateflag Example
Related Commands rm appfw learningdata reset appfw learningdata export appfw learningdata
reset appfw learningdata

Synopsis reset appfw learningdata Description Remove all databases. Make transaction count zero Arguments Example
Related Commands rm appfw learningdata show appfw learningdata export appfw learningdata
export appfw learningdata

Synopsis export appfw learningdata <profileName> <securityCheck> [-target <string>] Description Export appfw learnt data in csv format to the location /var/learnt_data/ Arguments profileName Application Firewall profile name.
securityCheck Security check. Possible values: startURL, cookieConsistency, fieldConsistency, crossSiteScripting, SQLInjection, fieldFormat, CSRFtag, XMLDoSCheck, XMLWSICheck, XMLAttachmentCheck, TotalXMLRequests target Target filename for data to be exported. Example
Related Commands rm appfw learningdata show appfw learningdata reset appfw learningdata
rm appfw wsdl
Synopsis rm appfw wsdl <name> Description Removes the object imported by import wsdl. Arguments name Indicates name of the imported wsdl to be removed. Example rm wsdl <name>
Related Commands show appfw wsdl import appfw wsdl
show appfw wsdl

Synopsis show appfw wsdl [<name>] Description Displays the object imported by import wsdl. Arguments name Indicates name of the importd wsdl to be displayed. response
Example show appfw wsdl
Related Commands rm appfw wsdl import appfw wsdl
import appfw wsdl

Synopsis import appfw wsdl <src> <name> [-comment <string>] [-overwrite] Description Compiles the input WSDL file into NetScaler native format. Arguments src Indicates the source of the WSDL file as a URL of the form <protocol>://<host>[:<port>][/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication. If the path contains a '?', escape the '?' with a backslash name Indicates name of the wsdl to import. comment Comments. overwrite Overwrites the existing file Example import appfw wsdl http://www.webservicex.net/stockquote.asmx?wsdl stockquote
Related Commands rm appfw wsdl show appfw wsdl
rm appfw signatures
Synopsis rm appfw signatures <name> Description Removes the object imported by import signatures.
Arguments name Indicates name of signature object. Example rm signatures <name>
Related Commands show appfw signatures import appfw signatures update appfw signatures
show appfw signatures

Synopsis show appfw signatures [<name>] Description Displays the object imported by import signatures. Arguments name Indicates name of signature object. response Example show appfw signatures
Related Commands rm appfw signatures import appfw signatures update appfw signatures
import appfw signatures

Synopsis import appfw signatures <src> <name> [-comment <string>] [-overwrite] Description Downloads the Application Firewall signatures XML configuration to the NetScaler Box with the given object name Arguments src Indicates the source of the signature file as a URL of the form <protocol>://<host>[:<port>][/ <path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https
server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication. name Indicates name of signature object. comment Comments. overwrite Overwrites the existing file Example import signatures http://www.example.com/ns/signatures.xml my-signature
Related Commands rm appfw signatures show appfw signatures update appfw signatures
update appfw signatures

Synopsis update appfw signatures <name> Description Updates the Application Firewall signatures XML configuration to the NetScaler Box with the given object name Arguments name Indicates name of the signature object to update. Example update signatures my-signatures
Related Commands rm appfw signatures show appfw signatures import appfw signatures
rm appfw xmlschema
Synopsis rm appfw xmlschema <name> Description Removes the object imported by import xmlschema.
Arguments name Indicates name of the imported xmlschema to be removed. Example rm xmlschema <name>
Related Commands show appfw xmlschema import appfw xmlschema
show appfw xmlschema

Synopsis show appfw xmlschema [<name>] Description Displays the object imported by import xmlschema. Arguments name Indicates name of the imported xmlschema to be displayed. response Example show appfw xmlschema
Related Commands rm appfw xmlschema import appfw xmlschema
import appfw xmlschema

Synopsis import appfw xmlschema <src> <name> [-comment <string>] [-overwrite] Description Compiles the input XML Schema file into NetScaler native format. Arguments src Indicates the source of the XML schema file as a URL of the form <protocol>://<host>[:<port>] [/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication.
name Indicates name of the xmlschema to import. comment Comments. overwrite Overwrites the existing file Example import xmlschema http://schemas.xmlsoap.org/soap/envelope/ soap Related Commands rm appfw xmlschema show appfw xmlschema
add appfw XMLContentType

Synopsis add appfw XMLContentType <XMLContenttypevalue> [-isRegex ( REGEX | NOTREGEX )] Description Add XML content type. This will classify a request/response with the specified content type as XML Arguments XMLContenttypevalue Content type to be classified as XML isRegex Is field name a regular expression? Possible values: REGEX, NOTREGEX Default value: NS_NOTREGEX Example
Related Commands rm appfw XMLContentType show appfw XMLContentType
rm appfw XMLContentType
Synopsis rm appfw XMLContentType <XMLContenttypevalue> Description Remove XML contenti type. Arguments XMLContenttypevalue Content type to be classified as XML
Example
Related Commands add appfw XMLContentType show appfw XMLContentType
show appfw XMLContentType

Synopsis show appfw XMLContentType [<XMLContenttypevalue>] Description Display all xml content types. Arguments XMLContenttypevalue Content type to be classified as XML summary fullValues format level isRegex Is field name a regular expression? count stateflag Example
Related Commands add appfw XMLContentType rm appfw XMLContentType
show appfw archive

Synopsis show appfw archive Description
Arguments response
Example show appfw archive
Related Commands export appfw archive import appfw archive rm appfw archive
export appfw archive

Synopsis export appfw archive <name> <target> Description Exports the archive file to the specified location Arguments name Name of tar archive target Path to the file to be exported Example
Related Commands show appfw archive import appfw archive rm appfw archive
import appfw archive

Synopsis import appfw archive <src> <name> Description Imports the archive file from specified location Arguments src Indicates the source of the tar archive file as a URL of the form <protocol>://<host>[:<port>] [/<path>] <protocol> is http or https. <host> is the DNS name or IP address of the http or https server. <port> is the port number of the server. If omitted, the default port for http or https will be used. <path> is the path of the file on the server. Import will fail if an https server requires client certificate authentication.
name Indicates name of archive Example
Related Commands show appfw archive export appfw archive rm appfw archive
rm appfw archive
Synopsis rm appfw archive <name> Description Removes the archive created by archive command. Arguments name Indicates name of the archive to be removed. Example rm appfw archive <name>
Related Commands show appfw archive export appfw archive import appfw archive
Chapter
7
Auditing Commands
Topics: stat audit add audit syslogAction rm audit syslogAction set audit syslogAction unset audit syslogAction show audit syslogAction add audit syslogPolicy rm audit syslogPolicy set audit syslogPolicy unset audit syslogPolicy show audit syslogPolicy add audit nslogAction rm audit nslogAction set audit nslogAction unset audit nslogAction show audit nslogAction add audit nslogPolicy rm audit nslogPolicy set audit nslogPolicy unset audit nslogPolicy show audit nslogPolicy add audit messageaction rm audit messageaction set audit messageaction unset audit messageaction show audit messageaction show audit stats show audit messages set audit syslogParams unset audit syslogParams show audit syslogParams set audit nslogParams unset audit nslogParams show audit nslogParams
192 | Citrix NetScaler 10 | Auditing Commands
stat audit
Synopsis stat audit [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display the audit statistics Arguments Audit logs sent to syslog server(s) (LogSnd) Syslog messages sent to the syslog server(s). Audit log messages generated (LogGen) Syslog messages about to be sent to the syslog server. NAT allocation failed (Ernatpcb) NAT allocation failed. Nsb allocation failed (Ernsb) Nsb allocation failed. Memory allocation failed (Ermem) Failures in allocation of Access Gateway context structure. When an Access Gateway session is established, the NetScaler creates an internal context structure , which identifies the user and the IP address from which the user has logged in. Port allocation failed (Erport) Number of times the NetScaler failed to allocate a port when sending a syslog message to the syslog server(s). NAT lookup failed (Hshmiss) NAT lookup failed. Context not found (Ctxntfnd) Failures in finding the context structure for an Access Gateway session during attempts to send session-specific audit messages. During an Access Gateway session, audit messages related to the session are queued up in the auditlog buffer for transmission to the audit log server(s). If the session is killed before the messages are sent, the context structure allocated at session creation is removed. This structure is needed for sending the queued auditlog messages. If it is not found, this counter is incremented. Nsb chain allocation failed (Ernsbchn) Nsb Chain allocation failed. Client connect failed (Erclconn) Failures in establishment of a connection between the NetScaler and the auditserver tool (the Netscaler's custom logging tool). MP buffer flush command count (flcmdcnt) Auditlog buffer flushes. In a multiprocessor NetScaler, both the main processor and the coprocessor can generate auditlog messages and fill up the auditlog buffers. But only the primary processor can free up the buffers by sending auditlog messages to the auditlog server(s). The number of auditlog buffers is fixed. If the co-processor detects that all the auditlog buffers are full, it issues a flush command to the main processor. Example
Citrix NetScaler 10 | Auditing Commands | 193
Related Commands
add audit syslogAction

Synopsis add audit syslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> ... [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] Description Add an syslog action Arguments name The name of the syslog action. serverIP The IP address of the syslog server. serverPort The port on which the syslog server is running. Minimum value: 1 logLevel The audit log level. dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestmps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands rm audit syslogAction set audit syslogAction
unset audit syslogAction show audit syslogAction
rm audit syslogAction
Synopsis rm audit syslogAction <name> Description Remove a previously configured syslog action. Note that the syslog action cannot be removed if it is bound to a syslog policy. Arguments name The name of the action . Example
Related Commands add audit syslogAction set audit syslogAction unset audit syslogAction show audit syslogAction
set audit syslogAction

Synopsis set audit syslogAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-logLevel <logLevel> ...] [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [appflowExport ( ENABLED | DISABLED )] Description Modify an existing syslog action. Arguments name The name for the syslog action. serverIP The IP address of the syslog server. serverPort The port on which the syslog server is running. Minimum value: 1 logLevel The audit log level.
dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestmps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands add audit syslogAction rm audit syslogAction unset audit syslogAction show audit syslogAction
unset audit syslogAction

Synopsis unset audit syslogAction <name> [-serverPort] [-logLevel] [-dateFormat] [-logFacility] [-tcp] [-acl] [-timeZone] [userDefinedAuditlog] [-appflowExport] [-serverIP] Description Reset an existing syslog action..Refer to the set audit syslogAction command for meanings of the arguments. Arguments Example
Related Commands add audit syslogAction rm audit syslogAction set audit syslogAction
show audit syslogAction
show audit syslogAction

Synopsis show audit syslogAction [<name>] Description Display details of the configured syslog action(s). Arguments name The name of the syslog action. If no syslog action name is provided, all the configured syslog actions will be displayed. summary fullValues format level serverIP The IP address of the syslog server. serverPort The port on which the syslog server is running. logLevel The audit log level. dateFormat The date format. logFacility The log facility (RFC 3164). tcp Log the tcp messages acl Log the acl messages timeZone Specifies the timezone in which the timestmps in the log messages will be generated stateflag userDefinedAuditlog Specifies whether the user configurable log messages should be done or not appflowExport Disable export of log messages to AppFlow collectors. count Example
Related Commands add audit syslogAction rm audit syslogAction set audit syslogAction unset audit syslogAction
add audit syslogPolicy

Synopsis add audit syslogPolicy <name> <rule> <action> Description Add a syslog policy. The policy defines the conditions under which the specified syslog server will be used for logging. Arguments name The name of syslog policy. rule The name of the rule or expression that the policy will use. Currently supports only the rule "ns_true". action The name of the syslog action to be bound to the the policy. Example
Related Commands rm audit syslogPolicy set audit syslogPolicy unset audit syslogPolicy show audit syslogPolicy
rm audit syslogPolicy
Synopsis rm audit syslogPolicy <name> Description Remove an audit syslog policy. Arguments name The name of the syslog policy. Example
Related Commands add audit syslogPolicy set audit syslogPolicy unset audit syslogPolicy show audit syslogPolicy
set audit syslogPolicy

Synopsis set audit syslogPolicy <name> [-rule <expression>] [-action <string>] Description Modify the properties of a syslog policy. Arguments name The name of syslog policy. rule The name of the rule or expression that the policy will use. Currently supports only the rule "ns_true". action The name of the syslog action to be bound to the the policy. Example
Related Commands add audit syslogPolicy rm audit syslogPolicy unset audit syslogPolicy show audit syslogPolicy
unset audit syslogPolicy

Synopsis unset audit syslogPolicy <name> [-rule] [-action] Description Use this command to remove audit syslogPolicy settings.Refer to the set audit syslogPolicy command for meanings of the arguments. Arguments Example
Related Commands add audit syslogPolicy rm audit syslogPolicy set audit syslogPolicy show audit syslogPolicy
show audit syslogPolicy

Synopsis show audit syslogPolicy [<name>] Description Display the configured syslog policies. Arguments name The name of the policy to be displayed. If the policy name is not provided, all the configured syslog policies will be displayed. summary fullValues format level rule The name of the rule or expression that the policy will use. Currently supports only the rule "ns_true". action The name of the syslog action to be bound to the the policy. boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag Example
Related Commands add audit syslogPolicy rm audit syslogPolicy
set audit syslogPolicy unset audit syslogPolicy
add audit nslogAction

Synopsis add audit nslogAction <name> <serverIP> [-serverPort <port>] -logLevel <logLevel> ... [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] Description Add an nslog action Arguments name The name of the nslog action. serverIP The IP address of the nslog server. serverPort The port on which the nslog server is running. Minimum value: 1 logLevel The audit log level. dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestmps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands rm audit nslogAction
set audit nslogAction unset audit nslogAction show audit nslogAction
rm audit nslogAction
Synopsis rm audit nslogAction <name> Description Remove a previously configured nslog action. Note that the nslog action cannot be removed if it is bound to an nslog policy. Arguments name The name of the nslog action. Example
Related Commands add audit nslogAction set audit nslogAction unset audit nslogAction show audit nslogAction
set audit nslogAction

Synopsis set audit nslogAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-logLevel <logLevel> ...] [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [appflowExport ( ENABLED | DISABLED )] Description Modify an existing nslog action. Arguments name The name for the nslog action. serverIP The IP address of the nslog server. serverPort The port on which the nslog server is running. Minimum value: 1 logLevel The audit log level.
dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestmps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands add audit nslogAction rm audit nslogAction unset audit nslogAction show audit nslogAction
unset audit nslogAction

Synopsis unset audit nslogAction <name> [-serverPort] [-logLevel] [-dateFormat] [-logFacility] [-tcp] [-acl] [-timeZone] [userDefinedAuditlog] [-appflowExport] Description Unsets an existing nslog action..Refer to the set audit nslogAction command for meanings of the arguments. Arguments Example
Related Commands add audit nslogAction rm audit nslogAction set audit nslogAction
show audit nslogAction
show audit nslogAction

Synopsis show audit nslogAction [<name>] Description Display details of the configured nslog action(s). Arguments name The name of the nslog action. If the nslog action name is not provided, all of the configured nslog actions will be displayed. summary fullValues format level serverIP The IP address of the nslog server. serverPort The port on which the nslog server is running. logLevel The audit log level. dateFormat The date format. logFacility The log facility (RFC 3164). tcp Log the tcp messages acl Log the acl messages timeZone Specifies the timezone in which the timestmps in the log messages will be generated stateflag userDefinedAuditlog Specifies whether the user configurable log messages should be done or not appflowExport Control export of log messages to AppFlow collectors. count Example
Related Commands add audit nslogAction rm audit nslogAction set audit nslogAction unset audit nslogAction
add audit nslogPolicy

Synopsis add audit nslogPolicy <name> <rule> <action> Description Add an nslog policy. The policy defines the conditions under which the specified nslog server will be used for logging. Arguments name The name of nslog policy. rule The name of the rule or expression that the policy will use. Currently supports only the rule "ns_true". action The name of the nslog action to be bound to the nslog policy. Example
Related Commands rm audit nslogPolicy set audit nslogPolicy unset audit nslogPolicy show audit nslogPolicy
rm audit nslogPolicy
Synopsis rm audit nslogPolicy <name> Description Remove an nslog policy. Arguments name The name of the nslog policy. Example
Related Commands add audit nslogPolicy set audit nslogPolicy unset audit nslogPolicy show audit nslogPolicy
set audit nslogPolicy

Synopsis set audit nslogPolicy <name> [-rule <expression>] [-action <string>] Description Modify properties of a nslog policy. Arguments name The name of the nslog policy to be modified. rule The new rule to be associated with the policy. action The new nslog action to be associated with the policy. Example
Related Commands add audit nslogPolicy rm audit nslogPolicy unset audit nslogPolicy show audit nslogPolicy
unset audit nslogPolicy

Synopsis unset audit nslogPolicy <name> [-rule] [-action] Description Use this command to remove audit nslogPolicy settings.Refer to the set audit nslogPolicy command for meanings of the arguments. Arguments Example
Related Commands add audit nslogPolicy rm audit nslogPolicy set audit nslogPolicy show audit nslogPolicy
show audit nslogPolicy

Synopsis show audit nslogPolicy [<name>] Description Display configured nslog policies. Arguments name The name of the nslog policy. If an nslog policy name is not provided, all of the configured nslog policies will be displayed. summary fullValues format level rule The name of the rule or expression that the policy will use. Currently supports only the rule "ns_true". action The name of the nslog action to be bound to the nslog policy. boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag Example
Related Commands add audit nslogPolicy rm audit nslogPolicy
set audit nslogPolicy unset audit nslogPolicy
add audit messageaction

Synopsis add audit messageaction <name> <logLevel> <stringBuilderExpr> [-logtoNewnslog ( YES | NO )] [bypassSafetyCheck ( YES | NO )] Description Add a audit message action Arguments name The name of the audit message action. logLevel The audit logLevel Possible values: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL, DEBUG, NONE stringBuilderExpr String builder expression which is a regular expression which will be used to build the log message logtoNewnslog The flag to control whether the message should go to the newnslog or not Possible values: YES, NO bypassSafetyCheck Bypass the safety check and allow unsafe expressions. Possible values: YES, NO Default value: NO Example
Related Commands rm audit messageaction set audit messageaction unset audit messageaction show audit messageaction
rm audit messageaction
Synopsis rm audit messageaction <name> Description Remove a previously configured audit message action Arguments name The name of the action .
Example
Related Commands add audit messageaction set audit messageaction unset audit messageaction show audit messageaction
set audit messageaction

Synopsis set audit messageaction <name> [-logLevel <logLevel>] [-stringBuilderExpr <string>] [-logtoNewnslog ( YES | NO )] [-bypassSafetyCheck ( YES | NO )] Description Set a audit message action Arguments name The name of the audit message action logLevel Set the audit logLevel Possible values: EMERGENCY, ALERT, CRITICAL, ERROR, WARNING, NOTICE, INFORMATIONAL, DEBUG, NONE stringBuilderExpr Set the string builder expression which is a regular expression which will be used to build the log message logtoNewnslog Set the flag to control whether the message should go to the newnslog or not Possible values: YES, NO bypassSafetyCheck Bypass the safety check and allow unsafe expressions. Possible values: YES, NO Default value: NO Example
Related Commands add audit messageaction rm audit messageaction unset audit messageaction show audit messageaction
unset audit messageaction

Synopsis unset audit messageaction <name> [-logtoNewnslog] [-bypassSafetyCheck]
Description Use this command to remove audit messageaction settings.Refer to the set audit messageaction command for meanings of the arguments. Arguments Example
Related Commands add audit messageaction rm audit messageaction set audit messageaction show audit messageaction
show audit messageaction

Synopsis show audit messageaction [<name>] Description Display details of the configured syslog action(s). Arguments name The name of the syslog action. If no syslog action name is provided, all the configured syslog actions will be displayed. summary fullValues format level logLevel The audit logLevelNOTE: This attribute is deprecated.This is deprecated - instead use loglevel2 logLevel stringBuilderExpr String builder expression which is a regular expression which will be used to build the log message logtoNewnslog The flag to control whether the message should go to the newnslog or not bypassSafetyCheck Bypass the safety check and allow unsafe expressions. stateflag hits The number of times the action has been taken.
undefHits The number of times the action resulted in UNDEF. referenceCount The number of references to the action. count Example
Related Commands add audit messageaction rm audit messageaction set audit messageaction unset audit messageaction
show audit stats

Synopsis show audit stats - alias for 'stat audit' Description show audit stats is an alias for stat audit Arguments Example
Related Commands stat audit
show audit messages

Synopsis show audit messages [-logLevel <logLevel> ...] [-numOfMesgs <positive_integer>] Description display the most recent audit log messages Arguments logLevel The log level filter. numOfMesgs The number of log messages to be printed. Default value: 20 Minimum value: 1 Maximum value: 256
summary fullValues value The Audit message count stateflag Example
Related Commands
set audit syslogParams

Synopsis set audit syslogParams [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logLevel <logLevel> ...] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] Description Modify the syslog parameters. Arguments serverIP The IP address of the syslog server. serverPort The port on which the syslog server is running. Minimum value: 1 dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logLevel The audit log level for which messages should be logged. logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestmps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO
appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands unset audit syslogParams show audit syslogParams
unset audit syslogParams

Synopsis unset audit syslogParams [-serverIP] [-serverPort] [-logLevel] [-dateFormat] [-logFacility] [-tcp] [-acl] [userDefinedAuditlog] [-appflowExport] [-timeZone] Description Unset syslog parameters.Refer to the set audit syslogParams command for meanings of the arguments. Arguments Example
Related Commands set audit syslogParams show audit syslogParams
show audit syslogParams

Synopsis show audit syslogParams Description Display configured syslog params. Arguments format level name Name. serverIP The IP address of the syslog server. serverPort
The port on which the syslog server is running. dateFormat The date format. logLevel The audit log level for which messages should be logged. logFacility The log facility (RFC 3164). tcp Log the tcp messages acl Log the acl messages timeZone Specifies the timezone in which the timestmps in the log messages will be generated userDefinedAuditlog Specifies whether the user configurable log messages should be done or not appflowExport Control export of log messages to AppFlow collectors. Example
Related Commands set audit syslogParams unset audit syslogParams
set audit nslogParams

Synopsis set audit nslogParams [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-dateFormat ( MMDDYYYY | DDMMYYYY )] [-logLevel <logLevel> ...] [-logFacility <logFacility>] [-tcp ( NONE | ALL )] [-acl ( ENABLED | DISABLED )] [-timeZone ( GMT_TIME | LOCAL_TIME )] [-userDefinedAuditlog ( YES | NO )] [-appflowExport ( ENABLED | DISABLED )] Description Modify the nslog parameters Arguments serverIP The IP address of the nslog server. serverPort The port on which the nslog server is running. Minimum value: 1 dateFormat The date format. Possible values: MMDDYYYY, DDMMYYYY logLevel The audit log level for which messages should be logged.
logFacility The log facility (RFC 3164). Possible values: LOCAL0, LOCAL1, LOCAL2, LOCAL3, LOCAL4, LOCAL5, LOCAL6, LOCAL7 tcp Log the tcp messages Possible values: NONE, ALL acl Log the acl messages Possible values: ENABLED, DISABLED timeZone Specifies the timezone in which the timestamps in the log messages will be generated Possible values: GMT_TIME, LOCAL_TIME userDefinedAuditlog Specifies whether the user configurable log messages should be done or not Possible values: YES, NO appflowExport Control export of log messages to AppFlow collectors. Possible values: ENABLED, DISABLED Example
Related Commands unset audit nslogParams show audit nslogParams
unset audit nslogParams

Synopsis unset audit nslogParams [-serverIP] [-serverPort] [-logLevel] [-dateFormat] [-logFacility] [-tcp] [-acl] [userDefinedAuditlog] [-appflowExport] [-timeZone] Description Unset nslog parameters.Refer to the set audit nslogParams command for meanings of the arguments. Arguments Example
Related Commands set audit nslogParams show audit nslogParams
show audit nslogParams

Synopsis show audit nslogParams
Description Display configured nslog params. Arguments format level name Name of the nslog param. serverIP The IP address of the nslog server. serverPort The port on which the nslog server is running. dateFormat The date format. logLevel The audit log level. logFacility The log facility (RFC 3164). tcp Log the tcp messages acl Log the acl messages timeZone Specifies the timezone in which the timestamps in the log messages will be generated userDefinedAuditlog Specifies whether the user configurable log messages should be done or not appflowExport Control export of log messages to AppFlow collectors. Example
Related Commands set audit nslogParams unset audit nslogParams
Chapter
8
Authentication Commands
Topics: add authentication samlAction add authentication radiusAction rm authentication radiusAction set authentication radiusAction unset authentication radiusAction show authentication radiusAction add authentication ldapAction rm authentication ldapAction set authentication ldapAction unset authentication ldapAction show authentication ldapAction add authentication tacacsAction rm authentication tacacsAction set authentication tacacsAction unset authentication tacacsAction show authentication tacacsAction add authentication nt4Action rm authentication nt4Action set authentication nt4Action unset authentication nt4Action show authentication nt4Action add authentication certAction rm authentication certAction set authentication certAction unset authentication certAction show authentication certAction add authentication localPolicy rm authentication localPolicy set authentication localPolicy unset authentication localPolicy show authentication localPolicy add authentication radiusPolicy
218 | Citrix NetScaler 10 | Authentication Commands
rm authentication radiusPolicy set authentication radiusPolicy unset authentication radiusPolicy show authentication radiusPolicy add authentication certPolicy rm authentication certPolicy set authentication certPolicy unset authentication certPolicy show authentication certPolicy add authentication ldapPolicy rm authentication ldapPolicy set authentication ldapPolicy unset authentication ldapPolicy show authentication ldapPolicy add authentication tacacsPolicy rm authentication tacacsPolicy set authentication tacacsPolicy unset authentication tacacsPolicy show authentication tacacsPolicy add authentication nt4Policy rm authentication nt4Policy set authentication nt4Policy unset authentication nt4Policy show authentication nt4Policy add authentication vserver rm authentication vserver set authentication vserver unset authentication vserver bind authentication vserver unbind authentication vserver enable authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
Citrix NetScaler 10 | Authentication Commands | 219
add authentication samlAction

Synopsis add authentication samlAction <name> {-samlIdPCertName <string>} {-samlSigningCertName <string>} {-samlRedirectUrl <string>} {-samlUserField <string>} {-samlRejectUnsignedAssertion ( ON | OFF )} {samlIssuerName <string>} Description Arguments name The name for the new SAML action. This is a mandatory argument. Maximum Length: 127 samlIdPCertName The name of the certificate to be used to decrypt messages from IdP. This is a mandatory argument. Maximum Length: 63 samlSigningCertName The name of the certificate to be used to sign messages to IdP. Maximum Length: 63 samlRedirectUrl The URL at the IdP to which user must be redirected for thentication. This is a mandatory argument. Maximum Length: 1791 samlUserField The field/tag from where username/id is to be extracted. Maximum Length: 63 samlRejectUnsignedAssertion The option to reject Assertions which come without Signature. Possible values: ON, OFF. Default value: OFF samlIssuerName The name to be used in requests sent from Netscaler to IdP to uniquely identify Netscaler. Maximum Length: 63 Example
Related Commands rm authentication samlAction set authentication samlAction unset authentication samlAction show authentication samlAction
add authentication radiusAction

Synopsis add authentication radiusAction <name> {-serverIP <ip_addr|ipv6_addr|*>} [-serverPort <port>] [-authTimeout <positive_integer>] {-radKey } [-radNASip ( ENABLED | DISABLED )] [-radNASid <string>] [-radVendorID <positive_integer>] [-radAttributeType <positive_integer>] [-radGroupsPrefix <string>] [-radGroupSeparator
<string>] [-passEncoding <passEncoding>] [-ipVendorID <positive_integer>] [-ipAttributeType <positive_integer>] [-accounting ( ON | OFF )] [-pwdVendorID <positive_integer> [-pwdAttributeType <positive_integer>]] Description Add a profile for a RADIUS server. The profile contains all the configuration data necessary to communicate with a RADIUS server. Arguments name The name of the RADIUS action. serverIP The IP address of the RADIUS server. serverPort The port on which the RADIUS Server is running. Default value: 1812 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the RADIUS server. Default value: 3 Minimum value: 1 radKey The key shared between the client and the server. This information is required for the system to communicate with the RADIUS server. radNASip If enabled, the system's IP address (NSIP) is sent to the server as the "nasip" in accordance with the RADIUS protocol. Possible values: ENABLED, DISABLED radNASid If configured, this string is sent to the RADIUS server as the "nasid" in accordance with the RADIUS protocol. radVendorID The vendor ID for using RADIUS group extraction. Minimum value: 1 radAttributeType The Attribute type for using RADIUS group extraction. Minimum value: 1 radGroupsPrefix The groups prefix string that precedes the group names within a RADIUS attribute for RADIUS group extraction. radGroupSeparator The group separator string that delimits group names within a RADIUS attribute for RADIUS group extraction. passEncoding This option specifies how passwords should be encoded in the radius packets traveling from the system to the RADIUS server. Possible values: pap, chap, mschapv1, mschapv2 Default value: AAA_PAP ipVendorID The vendor ID of the attribute in the RADIUS response which denotes the intranet IP. The value of 0 denotes that the attribute is not vendor encoded. Minimum value: 0 ipAttributeType The attribute type of the remote IP address attribute in a RADIUS response. Minimum value: 1 accounting The state of the RADIUS server that will receive accounting messages. Possible values: ON, OFF
pwdVendorID Vendor ID of the attribute in the RADIUS response which will be used to extract the user Password. Minimum value: 1 pwdAttributeType Attribute type of the vendor specific Password-Attribute in a RADIUS response. Minimum value: 1 Example Related Commands rm authentication radiusAction set authentication radiusAction unset authentication radiusAction show authentication radiusAction
rm authentication radiusAction
Synopsis rm authentication radiusAction <name> Description Remove a previously created RADIUS action. Note that an action cannot be removed as long as it is configured in a policy. Arguments name The name of the action to be removed. Example Related Commands add authentication radiusAction set authentication radiusAction unset authentication radiusAction show authentication radiusAction
set authentication radiusAction

Synopsis set authentication radiusAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] {-radKey } [-radNASip ( ENABLED | DISABLED )] [-radNASid <string>] [-radVendorID <positive_integer>] [-radAttributeType <positive_integer>] [-radGroupsPrefix <string>] [-radGroupSeparator <string>] [-passEncoding <passEncoding>] [-ipVendorID <positive_integer>] [-ipAttributeType <positive_integer>] [-accounting ( ON | OFF )] [-pwdVendorID <positive_integer>] [-pwdAttributeType <positive_integer>] Description Change the profile for a RADIUS server. The profile contains all the configuration data needed to communicate with a RADIUS server. Arguments name The name of the RADIUS action.
serverIP The IP address of the RADIUS server. serverPort The port on which RADIUS Server is running. Default value: 1812 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the RADIUS server. Default value: 3 Minimum value: 1 radKey The key shared between the client and the server. This information is required for the system to communicate with the RADIUS server. radNASip If enabled, the system's IP address (NSIP) is sent to the server as the "nasip" in accordance with the RADIUS protocol. Possible values: ENABLED, DISABLED radNASid If configured, this string is sent to the RADIUS server as the "nasid" in accordance with the RADIUS protocol. radVendorID The Vendor ID for using RADIUS group extraction. Minimum value: 1 radAttributeType The Attribute type for using RADIUS group extraction. Minimum value: 1 radGroupsPrefix The groups prefix string that precedes the group names within a RADIUS attribute for RADIUS group extraction. radGroupSeparator The group separator string that delimits group names within a RADIUS attribute for RADIUS group extraction. passEncoding This option specifies how passwords should be encoded in RADIUS packets traveling from the system to the RADIUS server. Possible values: pap, chap, mschapv1, mschapv2 Default value: AAA_PAP ipVendorID The vendor ID of the attribute in the RADIUS response which denotes the intranet IP. The value of 0 denotes that the attribute is not vendor encoded. Minimum value: 0 ipAttributeType The attribute type of the remote IP address attribute in a RADIUS response. Minimum value: 1 accounting The state of the RADIUS server that will receive accounting messages. Possible values: ON, OFF pwdVendorID Vendor ID of the attribute in the RADIUS response which will be used to extract the user Password. Minimum value: 1 Example
Related Commands add authentication radiusAction
rm authentication radiusAction unset authentication radiusAction show authentication radiusAction
unset authentication radiusAction

Synopsis unset authentication radiusAction <name> [-serverIP] [-serverPort] [-authTimeout] [-radNASip] [-radNASid] [radVendorID] [-radAttributeType] [-radGroupsPrefix] [-radGroupSeparator] [-passEncoding] [-ipVendorID] [ipAttributeType] [-accounting] [-pwdVendorID] [-pwdAttributeType] Description Use this command to remove authentication radiusAction settings.Refer to the set authentication radiusAction command for meanings of the arguments. Arguments Example
Related Commands add authentication radiusAction rm authentication radiusAction set authentication radiusAction show authentication radiusAction
show authentication radiusAction

Synopsis show authentication radiusAction [<name>] Description Display details of the configured RADIUS action(s). Arguments name The name of the RADIUS action. summary fullValues format level serverIP serverPort authTimeout radKey
radNASip IPAddress IP address. radNASid radVendorID radAttributeType radGroupsPrefix The groups prefix string that precedes the group names within a RADIUS attribute for RADIUS group extraction. radGroupSeparator The group separator string that delimits group names within a RADIUS attribute for RADIUS group extraction. passEncoding ipVendorID ipAttributeType accounting The state of the RADIUS server that will receive accounting messages. Success Failure stateflag pwdVendorID Vendor ID of the attribute in the RADIUS response which will be used to extract the user Password. pwdAttributeType Attribute type of the vendor specific Password-Attribute in a RADIUS response. count Example
Related Commands add authentication radiusAction rm authentication radiusAction set authentication radiusAction unset authentication radiusAction
add authentication ldapAction

Synopsis add authentication ldapAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] [-ldapBase <string>] [-ldapBindDn <string>] {-ldapBindDnPassword } [-ldapLoginName <string>] [-searchFilter <string>] [-groupAttrName <string>] [-subAttributeName <string>] [-secType <secType>] [-ssoNameAttribute <string>] [-authentication ( ENABLED | DISABLED )] [-requireUser ( YES | NO )]
[-passwdChange ( ENABLED | DISABLED )] [-nestedGroupExtraction ( ON | OFF ) [-maxNestingLevel <positive_integer>] [-groupSearchSubAttribute <string>] [-groupSearchFilter <string>]] [-groupNameIdentifier <string>] [-groupSearchAttribute <string>] Description Add a profile for an LDAP server. This profile contains all the configuration data needed to communicate with the LDAP server.. Arguments name The name for the new LDAP action. serverIP The IP address of the LDAP server. serverPort The port number on which the LDAP server is running. Default value: 389 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the LDAP server. Default value: 3 Minimum value: 1 ldapBase The base, or node where the ldapsearch should start. If the LDAP server is running locally, the default value of base is dc=netscaler, dc=com. ldapBindDn The full distinguished name that is used to bind to the LDAP server. The default value of the bindDN is cn=Manager,dc=netscaler,dc=com. ldapBindDnPassword The password that is used to bind to the LDAP server. ldapLoginName The name attribute used by the system to query the external LDAP server or an Active Directory. searchFilter The string to be combined with the default LDAP user search string to form the value. For example, vpnallowed=true with ldaploginame "samaccount" and the user-supplied username "bob" would yield the LDAP search string "(&(vpnallowed=true)(samaccount=bob)". groupAttrName The Attribute name for group extraction from the LDAP server. subAttributeName The Sub-Attribute name for group extraction from the LDAP server. secType This option indicates whether communication between the system and the authentication server should be encrypted. The following values are allowed: PLAINTEXT: No encryption required. TLS: Communicate using TLS protocol. SSL: Communicate using SSL Protocol. Possible values: PLAINTEXT, TLS, SSL Default value: AAA_LDAP_PLAINTEXT ssoNameAttribute The attribute used by the system to query the external LDAP server, or an Active Directory, for an alternate username to be used in Single Sign-On. authentication Disable authentication. If disabled this LDAP action will return authentication success if the user is found. This should only be used for authorization group extraction and in conjuction with other
authentication methods. The other authentication methods should be bound to a primary list or flagged as secondary. Possible values: ENABLED, DISABLED Default value: ENABLED requireUser Setting this option to NO allows failed user searches to be considered authentication successes. If you set require user to NO, you may only configure it with authentication DISABLED Possible values: YES, NO Default value: YES passwdChange Enabling this option does not block password change request.Disabling would block password change request. Possible values: ENABLED, DISABLED Default value: DISABLED nestedGroupExtraction Setting this option to ON enables the nested group extraction feature where the system queries the external LDAP server to determine if a group belongs to another group Possible values: ON, OFF Default value: OFF maxNestingLevel If NESTED GROUP EXTRACTION is set to ON, this option specifies the level upto which ancestors of a group/subgroup will be determined Default value: 2 Minimum value: 2 groupNameIdentifier The group-attribute used by the system to uniquely identify a group in LDAP/AD groupSearchAttribute This option specifies the attribute that will be used to determine group-membership of a 'group' groupSearchSubAttribute This option specifies the sub-attribute that will be used to determine group-membership of a 'group' groupSearchFilter The string to be combined with the default LDAP group search string to form the value. For example, vpnallowed=true with groupIdentifier "samaccount" and the groupname "g1" would yield the LDAP search string "(&(vpnallowed=true)(samaccount=g1)". Example
Related Commands rm authentication ldapAction set authentication ldapAction unset authentication ldapAction show authentication ldapAction
rm authentication ldapAction
Synopsis rm authentication ldapAction <name> Description Remove an LDAP action. Note that an action cannot be removed as long as it is configured in a policy. Arguments name
The name of the LDAP action to be removed. Example
Related Commands add authentication ldapAction set authentication ldapAction unset authentication ldapAction show authentication ldapAction
set authentication ldapAction

Synopsis set authentication ldapAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] [-ldapBase <string>] [-ldapBindDn <string>] {-ldapBindDnPassword } [-ldapLoginName <string>] [-searchFilter <string>] [-groupAttrName <string>] [-subAttributeName <string>] [-secType <secType>] [-ssoNameAttribute <string>] [-authentication ( ENABLED | DISABLED )] [-requireUser ( YES | NO )] [passwdChange ( ENABLED | DISABLED )] [-nestedGroupExtraction ( ON | OFF )] [-maxNestingLevel <positive_integer>] [-groupNameIdentifier <string>] [-groupSearchAttribute <string> [-groupSearchSubAttribute <string>]] [-groupSearchFilter <string>] Description Changes the profile of an LDAP server. The profile contains all of the configuration data needed to communicate with the LDAP server. Arguments name The name for the new LDAP action. serverIP The IP address of the LDAP server. serverPort The port number on which the LDAP server is running. Default value: 389 Minimum value: 1 authTimeout The maximum number of seconds for the system will wait for a response from the LDAP server. Default value: 3 Minimum value: 1 ldapBase The base, or node, where the ldapsearch should start. If the LDAP server is running locally, the default value of base is dc=netscaler, dc=com. ldapBindDn The full distinguished name that is used to bind to the LDAP server. The default value of the bindDN is cn=Manager,dc=netscaler,dc=com. ldapBindDnPassword The password that is used to bind to the LDAP server. ldapLoginName The name attribute used by the system to query the external LDAP server or an Active Directory. searchFilter
The string to be combined with the default LDAP user search string to form the value.For example, vpnallowed=true with ldaploginame "samaccount" and the user-supplied username "bob" would yield the LDAP search string "(&(vpnallowed=true)(samaccount=bob)". groupAttrName The Attribute name for group extraction from the LDAP server. subAttributeName The Sub-Attribute name for group extraction from the LDAP server. secType This option indicates whether communication between the system and the authentication server should be encrypted. The following values are allowed: PLAINTEXT: No encryption required. TLS: Communicate using TLS protocol. SSL: Communicate using SSL protocol. Possible values: PLAINTEXT, TLS, SSL Default value: AAA_LDAP_PLAINTEXT ssoNameAttribute The attribute used by the system to query the external LDAP server, or an Active Directory, for an alternate username to be used in Single Sign-On. authentication Disable authentication. If disabled this LDAP action will return authentication success if the user is found. This should only be used for authorization group extraction and in conjuction with other authentication methods. The other authentication methods should be bound to a primary list or flagged as secondary. Possible values: ENABLED, DISABLED Default value: ENABLED requireUser This option allows failed searches to be considered authentication successes. If you set require user to NO, you may only configure it with authentication DISABLED Possible values: YES, NO Default value: YES passwdChange Enabling this option does not block password change request.Disabling would block password change request. Possible values: ENABLED, DISABLED Default value: DISABLED nestedGroupExtraction Setting this option to ON enables the nested group extraction feature where the system queries the external LDAP server to determine if a group belongs to another group Possible values: ON, OFF Default value: OFF Example
Related Commands add authentication ldapAction rm authentication ldapAction unset authentication ldapAction show authentication ldapAction
unset authentication ldapAction

Synopsis unset authentication ldapAction <name> [-serverIP] [-serverPort] [-authTimeout] [-ldapBase] [-ldapBindDn] [ldapBindDnPassword] [-ldapLoginName] [-searchFilter] [-groupAttrName] [-subAttributeName] [-secType] [ssoNameAttribute] [-authentication] [-requireUser] [-passwdChange] [-nestedGroupExtraction] [-maxNestingLevel] [-groupNameIdentifier] [-groupSearchAttribute] [-groupSearchSubAttribute] [-groupSearchFilter]
Description Use this command to remove authentication ldapAction settings.Refer to the set authentication ldapAction command for meanings of the arguments. Arguments Example
Related Commands add authentication ldapAction rm authentication ldapAction set authentication ldapAction show authentication ldapAction
show authentication ldapAction

Synopsis show authentication ldapAction [<name>] Description Display details of the configured LDAP action(s). Arguments name The name of the LDAP action. summary fullValues format level serverIP serverPort authTimeout ldapBindDn ldapLoginName ldapBase searchFilter groupAttrName subAttributeName secType ssoNameAttribute authentication
requireUser Success Failure stateflag nestedGroupExtraction maxNestingLevel groupNameIdentifier groupSearchAttribute groupSearchSubAttribute groupSearchFilter passwdChange count Example
Related Commands add authentication ldapAction rm authentication ldapAction set authentication ldapAction unset authentication ldapAction
add authentication tacacsAction

Synopsis add authentication tacacsAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] {-tacacsSecret } [-authorization ( ON | OFF )] [-accounting ( ON | OFF )] Description Add a profile for a TACACS+ server. The profile contains all of the configuration data needed to communicate with the TACACS+ server. Arguments name The name for the new TACACS+ action. serverIP The IP address of the TACACS+ server. serverPort The port on which the TACACS+ server is running. Default value: 49 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the TACACS+ server. Default value: 3 Minimum value: 1
tacacsSecret The key shared between the client and the server. This information is required for the system to communicate with the TACACS+ server. authorization The state of the TACACS+ server that will be used for streaming authorization. Possible values: ON, OFF accounting The state of the TACACS+ server that will receive accounting messages. Possible values: ON, OFF Example
Related Commands rm authentication tacacsAction set authentication tacacsAction unset authentication tacacsAction show authentication tacacsAction
rm authentication tacacsAction
Synopsis rm authentication tacacsAction <name> Description Remove a TACACS+ action. Note that an action cannot be removed if it is configured in a policy. Arguments name The name of TACACS+ action to be removed. Example
Related Commands add authentication tacacsAction set authentication tacacsAction unset authentication tacacsAction show authentication tacacsAction
set authentication tacacsAction

Synopsis set authentication tacacsAction <name> [-serverIP <ip_addr|ipv6_addr|*>] [-serverPort <port>] [-authTimeout <positive_integer>] {-tacacsSecret } [-authorization ( ON | OFF )] [-accounting ( ON | OFF )] Description Changes the profile for a TACACS+ server. The profile contains all the configuration data needed to communicate with the TACACS+ server.
Arguments name The name for the new TACACS+ action. serverIP The IP address of the TACACS+ server. serverPort The port on which the TACACS+ server is running. Default value: 49 Minimum value: 1 authTimeout The maximum number of seconds the system will wait for a response from the TACACS+ server. Default value: 3 Minimum value: 1 tacacsSecret The key shared between the client and the server. This information is required for the system to communicate with the TACACS+ server. authorization The state of the TACACS+ server to be used for streaming authorization. Possible values: ON, OFF accounting The state of the TACACS+ server that will receive accounting messages. Possible values: ON, OFF Example
Related Commands add authentication tacacsAction rm authentication tacacsAction unset authentication tacacsAction show authentication tacacsAction
unset authentication tacacsAction

Synopsis unset authentication tacacsAction <name> [-serverIP] [-serverPort] [-authTimeout] [-tacacsSecret] [-authorization] [accounting] Description Use this command to remove authentication tacacsAction settings.Refer to the set authentication tacacsAction command for meanings of the arguments. Arguments Example
Related Commands add authentication tacacsAction rm authentication tacacsAction set authentication tacacsAction show authentication tacacsAction
show authentication tacacsAction

Synopsis show authentication tacacsAction [<name>] Description Display details of the configured TACACS+ action(s). Arguments name The name of the TACACS+ action. summary fullValues format level serverIP serverPort authTimeout tacacsSecret authorization The state of the TACACS+ server that will be used for streaming authorization. accounting The state of the TACACS+ server that will receive accounting messages. Success Failure stateflag count Example
Related Commands add authentication tacacsAction rm authentication tacacsAction set authentication tacacsAction unset authentication tacacsAction
add authentication nt4Action

Synopsis add authentication nt4Action <name> [-serverIP <ip_addr|ipv6_addr|*>] [-nt4ServerName <string>] [nt4DomainName <string>] [-nt4AdminUser <string>] {-nt4AdminPasswd }
Description Add a profile for an NT4 server. The profile contains all of the configuration data needed to communicate with the NT4 server. Arguments name The name for the new NT4 action. serverIP The IP address of the NT4 server. nt4ServerName The name of the NT4 server nt4DomainName The domain name of the NT4 server nt4AdminUser The username of an NT4 Domain Administrator nt4AdminPasswd The password of the NT4 Domain Administrator Example
Related Commands rm authentication nt4Action set authentication nt4Action unset authentication nt4Action show authentication nt4Action
rm authentication nt4Action
Synopsis rm authentication nt4Action <name> Description Remove an NT4 action. Note that an action cannot be removed if it is configured in a policy. Arguments name The name of the NT4 action to be removed. Example
Related Commands add authentication nt4Action set authentication nt4Action
unset authentication nt4Action show authentication nt4Action
set authentication nt4Action

Synopsis set authentication nt4Action <name> [-serverIP <ip_addr|ipv6_addr|*>] [-nt4ServerName <string>] [nt4DomainName <string>] [-nt4AdminUser <string>] {-nt4AdminPasswd } Description Changes the profile for an NT4 server. The profile contains all of the configuration data needed to communicate with the NT4 server. Arguments name The name for the new NT4 action. serverIP The IP address of the NT4 server. nt4ServerName The name of the NT4 server nt4DomainName The domain name of the NT4 server nt4AdminUser The username of an NT4 Domain Administrator nt4AdminPasswd The password of the NT4 Domain Administrator Example
Related Commands add authentication nt4Action rm authentication nt4Action unset authentication nt4Action show authentication nt4Action
unset authentication nt4Action

Synopsis unset authentication nt4Action <name> [-serverIP] [-nt4ServerName] [-nt4DomainName] [-nt4AdminUser] [nt4AdminPasswd] Description Use this command to remove authentication nt4Action settings.Refer to the set authentication nt4Action command for meanings of the arguments.
Arguments Example
Related Commands add authentication nt4Action rm authentication nt4Action set authentication nt4Action show authentication nt4Action
show authentication nt4Action

Synopsis show authentication nt4Action [<name>] Description Display the details of the configured NT4 action(s). Arguments name The name of the NT4 action. summary fullValues format level serverIP nt4ServerName nt4DomainName nt4AdminUser Success Failure stateflag count Example
Related Commands add authentication nt4Action rm authentication nt4Action set authentication nt4Action unset authentication nt4Action
add authentication certAction

Synopsis add authentication certAction <name> [-twoFactor ( ON | OFF )] [-userNameField <string>] [-groupNameField <string>] Description Add a certificate action. Arguments name The name of the CERT action. twoFactor The state of two factor authentication. Two factor authentication means client certificate authentication followed by password authentication. Possible values: ON, OFF Default value: OFF userNameField The field in the client certificate from which the username will be extracted. Should be of the format <field:subfield>. Allowed values for the field are "Subject" and "Issuer". groupNameField The field in the certificate from which the group will be extracted. Should be of the format <field:subfield>. Allowed values for the field are "Subject" and "Issuer". Example add authentication certaction -twoFactor ON -userNameField "Subject:CN" -groupNameField "Subject:OU" Related Commands add aaa certparam add authentication certpolicy rm authentication certAction set authentication certAction unset authentication certAction show authentication certAction
rm authentication certAction
Synopsis rm authentication certAction <name> Description Remove a cert action. Note that an action cannot be removed if it is configured in a policy. Arguments name The name of the NT4 action to be removed. Example
Related Commands add authentication certAction set authentication certAction unset authentication certAction show authentication certAction
set authentication certAction

Synopsis set authentication certAction <name> [-twoFactor ( ON | OFF )] [-userNameField <string>] [-groupNameField <string>] Description Modifies the certificate action. Arguments name The name of the CERT action. twoFactor The state of two factor authentication. Two factor authentication means client certificate authentication followed by password authentication. Possible values: ON, OFF Default value: OFF userNameField The field in the client certificate from which the username will be extracted. Should be of the format <field:subfield>. Allowed values for the field are "Subject" and "Issuer". groupNameField The field in the certificate from which the group will be extracted. Should be of the format <field:subfield>. Allowed values for the field are "Subject" and "Issuer". Example set authentication certaction -twoFactor ON -userNameField "Subject:CN" -groupNameField "Subject:OU"
Related Commands add aaa certparam add authentication certpolicy add authentication certAction rm authentication certAction unset authentication certAction show authentication certAction
unset authentication certAction

Synopsis unset authentication certAction <name> [-twoFactor] [-userNameField] [-groupNameField]
Description Use this command to remove authentication certAction settings.Refer to the set authentication certAction command for meanings of the arguments. Arguments Example
Related Commands add authentication certAction rm authentication certAction set authentication certAction show authentication certAction
show authentication certAction

Synopsis show authentication certAction [<name>] Description Display the details of configured CERT action(s). Arguments name The name of the CERT action. summary fullValues format level twoFactor The state of two factor authentication. userNameField The field in the certificate from which the username will be extracted. groupNameField The field in the certificate from which the group will be extracted. stateflag count Example
Related Commands add authentication certAction rm authentication certAction
set authentication certAction unset authentication certAction
add authentication localPolicy

Synopsis add authentication localPolicy <name> <rule> Description Add an authentication LOCAL policy. The policy defines the conditions under which the kernel will authenticate the user. Arguments name The name of the new authentication LOCAL policy. rule The name of the rule or expression the policy will use. Example
Related Commands rm authentication localPolicy set authentication localPolicy unset authentication localPolicy show authentication localPolicy
rm authentication localPolicy
Synopsis rm authentication localPolicy <name> Description Remove an authentication LOCAL policy. Arguments name The name of the LOCAL policy to remove. Example
Related Commands add authentication localPolicy set authentication localPolicy unset authentication localPolicy show authentication localPolicy
set authentication localPolicy

Synopsis set authentication localPolicy <name> -rule <expression> Description Change properties of a LOCAL policy. Arguments name The name of the policy. rule The new rule to be associated with the policy. Example
Related Commands add authentication localPolicy rm authentication localPolicy unset authentication localPolicy show authentication localPolicy
unset authentication localPolicy

Synopsis unset authentication localPolicy <name> -rule Description Use this command to remove authentication localPolicy settings.Refer to the set authentication localPolicy command for meanings of the arguments. Arguments Example
Related Commands add authentication localPolicy rm authentication localPolicy set authentication localPolicy show authentication localPolicy
show authentication localPolicy

Synopsis show authentication localPolicy [<name>]
Description Display configured LOCAL policies. Arguments name The name of the policy. If a name is not provided, all the configured LOCAL policies will be displayed. summary fullValues format level rule The new rule associated with the policy. boundTo The entity name to which policy is bound activePolicy priority reqAction The name of the RADIUS action the policy uses count stateflag Example
Related Commands add authentication localPolicy rm authentication localPolicy set authentication localPolicy unset authentication localPolicy
add authentication radiusPolicy

Synopsis add authentication radiusPolicy <name> <rule> [<reqAction>] Description Add an authentication RADIUS policy. The policy defines the conditions under which the specified RADIUS server will be used for authentication. Arguments name The name of the new authentication RADIUS policy. rule
The name of the rule or expression the policy will use. reqAction The name of the RADIUS action the policy will use. Example
Related Commands rm authentication radiusPolicy set authentication radiusPolicy unset authentication radiusPolicy show authentication radiusPolicy
rm authentication radiusPolicy
Synopsis rm authentication radiusPolicy <name> Description Remove an authentication RADIUS policy. Arguments name The name of the RADIUS policy to remove. Example
Related Commands add authentication radiusPolicy set authentication radiusPolicy unset authentication radiusPolicy show authentication radiusPolicy
set authentication radiusPolicy

Synopsis set authentication radiusPolicy <name> [-rule <expression>] [-reqAction <string>] Description Change properties of a RADIUS policy. Arguments name The name of the policy. rule The new rule to be associated with the policy.
reqAction The new RADIUS action to be associated with the policy. Example
Related Commands add authentication radiusPolicy rm authentication radiusPolicy unset authentication radiusPolicy show authentication radiusPolicy
unset authentication radiusPolicy

Synopsis unset authentication radiusPolicy <name> [-rule] [-reqAction] Description Use this command to remove authentication radiusPolicy settings.Refer to the set authentication radiusPolicy command for meanings of the arguments. Arguments Example
Related Commands add authentication radiusPolicy rm authentication radiusPolicy set authentication radiusPolicy show authentication radiusPolicy
show authentication radiusPolicy

Synopsis show authentication radiusPolicy [<name>] Description Display configured RADIUS policies. Arguments name The name of the policy. If no name is provided, all the configured RADIUS policies will be displayed. summary fullValues format
level rule The new rule associated with the policy. reqAction The new RADIUS action associated with the policy. boundTo The entity name to which policy is bound activePolicy priority count stateflag Example
Related Commands add authentication radiusPolicy rm authentication radiusPolicy set authentication radiusPolicy unset authentication radiusPolicy
add authentication certPolicy

Synopsis add authentication certPolicy <name> <rule> [<reqAction>] Description Add an authentication cert policy. This policy defines the conditions under which the specified cert action will be used for authentication. Arguments name The name for the new policy. rule The name of the rule or expression the policy will use. reqAction The cert action to associate with the policy. Example
Related Commands rm authentication certPolicy set authentication certPolicy unset authentication certPolicy
show authentication certPolicy
rm authentication certPolicy
Synopsis rm authentication certPolicy <name> Description Remove a CERT authentication policy. Arguments name The name of the CERT policy to be removed. Example
Related Commands add authentication certPolicy set authentication certPolicy unset authentication certPolicy show authentication certPolicy
set authentication certPolicy

Synopsis set authentication certPolicy <name> [-rule <expression>] [-reqAction <string>] Description Change the properties of a CERT policy. Arguments name The name of the policy. rule The new rule to associate with the policy. reqAction The new cert action to associate to the policy. Example
Related Commands add authentication certPolicy rm authentication certPolicy unset authentication certPolicy show authentication certPolicy
unset authentication certPolicy

Synopsis unset authentication certPolicy <name> [-rule] [-reqAction] Description Use this command to remove authentication certPolicy settings.Refer to the set authentication certPolicy command for meanings of the arguments. Arguments Example
Related Commands add authentication certPolicy rm authentication certPolicy set authentication certPolicy show authentication certPolicy
show authentication certPolicy

Synopsis show authentication certPolicy [<name>] Description Display configured CERT policies. Arguments name The name of the policy. If a name is not provided, all of the configured policies are displayed. summary fullValues format level rule The rule associated with the policy. reqAction The cert action associated with the policy. boundTo The entity name to which policy is bound activePolicy priority count
stateflag Example
Related Commands add authentication certPolicy rm authentication certPolicy set authentication certPolicy unset authentication certPolicy
add authentication ldapPolicy

Synopsis add authentication ldapPolicy <name> <rule> [<reqAction>] Description Add an authentication LDAP policy. This policy defines the conditions under which the specified LDAP server will be used for authentication. Arguments name The name for the new policy. rule The name of the rule or expression the policy will use. reqAction The LDAP action to associate with the policy. Example
Related Commands rm authentication ldapPolicy set authentication ldapPolicy unset authentication ldapPolicy show authentication ldapPolicy
rm authentication ldapPolicy
Synopsis rm authentication ldapPolicy <name> Description Remove an LDAP authentication policy. Arguments name The name of the LDAP policy to be removed.
Example
Related Commands add authentication ldapPolicy set authentication ldapPolicy unset authentication ldapPolicy show authentication ldapPolicy
set authentication ldapPolicy

Synopsis set authentication ldapPolicy <name> [-rule <expression>] [-reqAction <string>] Description Change properties of an LDAP policy. Arguments name The name of the policy. rule The new rule to associate with the policy. reqAction The new LDAP action to associate with the policy. Example
Related Commands add authentication ldapPolicy rm authentication ldapPolicy unset authentication ldapPolicy show authentication ldapPolicy
unset authentication ldapPolicy

Synopsis unset authentication ldapPolicy <name> [-rule] [-reqAction] Description Use this command to remove authentication ldapPolicy settings.Refer to the set authentication ldapPolicy command for meanings of the arguments. Arguments Example
Related Commands add authentication ldapPolicy rm authentication ldapPolicy set authentication ldapPolicy show authentication ldapPolicy
show authentication ldapPolicy

Synopsis show authentication ldapPolicy [<name>] Description Display configured LDAP policies. Arguments name The name of the policy. If a name is not provided, all of the configured policies are displayed. summary fullValues format level rule reqAction boundTo The entity name to which policy is bound activePolicy priority count stateflag Example
Related Commands add authentication ldapPolicy rm authentication ldapPolicy set authentication ldapPolicy unset authentication ldapPolicy
add authentication tacacsPolicy

Synopsis add authentication tacacsPolicy <name> <rule> [<reqAction>]
Description Add an authentication TACACS+ policy. This policy defines the conditions under which the specified TACACS+ server will be used for authentication. Arguments name The name of the new TACACS+ policy. rule The name of the rule or expression the policy will use. reqAction The name of the TACACS+ action to be associated with the policy. Example
Related Commands rm authentication tacacsPolicy set authentication tacacsPolicy unset authentication tacacsPolicy show authentication tacacsPolicy
rm authentication tacacsPolicy
Synopsis rm authentication tacacsPolicy <name> Description Remove a TACACS+ policy. Arguments name The name of the TACACS+ policy to be removed. Example
Related Commands add authentication tacacsPolicy set authentication tacacsPolicy unset authentication tacacsPolicy show authentication tacacsPolicy
set authentication tacacsPolicy

Synopsis set authentication tacacsPolicy <name> [-rule <expression>] [-reqAction <string>] Description Change the properties of a TACACS+ policy.
Arguments name The name of the policy. rule The new rule to associate with the policy. reqAction The new TACACS+ action to associate to the policy. Example
Related Commands add authentication tacacsPolicy rm authentication tacacsPolicy unset authentication tacacsPolicy show authentication tacacsPolicy
unset authentication tacacsPolicy

Synopsis unset authentication tacacsPolicy <name> [-rule] [-reqAction] Description Use this command to remove authentication tacacsPolicy settings.Refer to the set authentication tacacsPolicy command for meanings of the arguments. Arguments Example
Related Commands add authentication tacacsPolicy rm authentication tacacsPolicy set authentication tacacsPolicy show authentication tacacsPolicy
show authentication tacacsPolicy

Synopsis show authentication tacacsPolicy [<name>] Description Display the configured TACACS+ policies. Arguments name
The name of the TACACS+ policy. If no name is given, all of the configured TACACS+ policies are displayed. summary fullValues format level rule reqAction boundTo The entity name to which policy is bound activePolicy priority count stateflag Example
Related Commands add authentication tacacsPolicy rm authentication tacacsPolicy set authentication tacacsPolicy unset authentication tacacsPolicy
add authentication nt4Policy

Synopsis add authentication nt4Policy <name> <rule> [<reqAction>] Description Add an authentication NT4 policy. The policy defines the conditions under which the specified NT4 server will be used for authentication. Arguments name The name for the new NT4 policy. rule The name of the rule or expression the policy will use. reqAction The NT4 action the policy will use. Example
Related Commands rm authentication nt4Policy set authentication nt4Policy unset authentication nt4Policy show authentication nt4Policy
rm authentication nt4Policy
Synopsis rm authentication nt4Policy <name> Description Remove an NT4 policy. Arguments name The name of the NT4 policy to remove. Example
Related Commands add authentication nt4Policy set authentication nt4Policy unset authentication nt4Policy show authentication nt4Policy
set authentication nt4Policy

Synopsis set authentication nt4Policy <name> [-rule <expression>] [-reqAction <string>] Description Change the properties of an NT4 policy. Arguments name The name of the NT4 policy. rule The name of the new rule to be associated with the policy. reqAction The name of the NT4 action to be associated with the policy. Example
Related Commands add authentication nt4Policy
rm authentication nt4Policy unset authentication nt4Policy show authentication nt4Policy
unset authentication nt4Policy

Synopsis unset authentication nt4Policy <name> [-rule] [-reqAction] Description Use this command to remove authentication nt4Policy settings.Refer to the set authentication nt4Policy command for meanings of the arguments. Arguments Example
Related Commands add authentication nt4Policy rm authentication nt4Policy set authentication nt4Policy show authentication nt4Policy
show authentication nt4Policy

Synopsis show authentication nt4Policy [<name>] Description Display NT4 policies. Arguments name The name of the NT4 policy. If no name is given, all the configured NT4 policies will be displayed. summary fullValues format level rule The name of the new rule associated with the policy. reqAction The name of the NT4 action associated with the policy. boundTo The entity name to which policy is bound activePolicy
priority count stateflag Example
Related Commands add authentication nt4Policy rm authentication nt4Policy set authentication nt4Policy unset authentication nt4Policy
add authentication vserver

Synopsis add authentication vserver <name> <serviceType> (<IPAddress> [-range <positive_integer>]) <port> [-state ( ENABLED | DISABLED )] [-authentication ( ON | OFF )] [-AuthenticationDomain <string>] Description Add an authentication virtual server. Arguments name The name for the new authentication vserver. serviceType The authentication vserver's protocol type, e.g. SSL Possible values: SSL Default value: NSSVC_SSL IPAddress The IP address for the authentication vserver. port The TCP port on which the vserver listens. Minimum value: 1 state The intital vserver server state, e.g. ENABLED or DISABLED Possible values: ENABLED, DISABLED Default value: ENABLED authentication Indicates whether or not authentication is being applied to incoming users to the vserver. Possible values: ON, OFF Default value: ON AuthenticationDomain Domain of authentication vserver FQDN Maximum value: 252 Example The following example creates an authentication vserver named myauthenticationvip which supports SSL portocol and with AAA functionality enabled: vserver myauthenticationvip SSL 65.219.17.34 443 -aaa ON
Related Commands rm authentication vserver set authentication vserver unset authentication vserver enable authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
rm authentication vserver
Synopsis rm authentication vserver <name>@ ... Description Remove a virtual server. Arguments name The name of the virtual server to be removed. Example rm vserver authn_vip Related Commands add authentication vserver set authentication vserver unset authentication vserver enable authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
set authentication vserver

Synopsis set authentication vserver <name> [-IPAddress <ip_addr|ipv6_addr|*>] [-authentication ( ON | OFF )] [AuthenticationDomain <string>] Description Change the parameters of a authentication virtual server. Arguments name
The name of the vserver to be modified. IPAddress The new IP address of the virtual server. authentication Indicates whether authentication is ON/OFF on this vserver. Possible values: ON, OFF Default value: ON AuthenticationDomain Domain of authentication vserver FQDN Maximum value: 252 Example
Related Commands add authentication vserver rm authentication vserver unset authentication vserver enable authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
unset authentication vserver

Synopsis unset authentication vserver <name> [-AuthenticationDomain] [-authentication] Description Unset the parameters of an authentication virtual server..Refer to the set authentication vserver command for meanings of the arguments. Arguments Example
Related Commands add authentication vserver rm authentication vserver set authentication vserver enable authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
bind authentication vserver

Synopsis bind authentication vserver <name> [-policy <string> [-priority <positive_integer>] [-secondary]] Description Bind policies to a authentication vserver. Arguments name The vserver to which this command shall bind parameters. policy The name of the policy to be bound to the vserver. Example
Related Commands unbind authentication vserver
unbind authentication vserver

Synopsis unbind authentication vserver <name> [-policy <string> [-secondary]] Description Unbind policies from a authentication vserver. Arguments name The name of the vserver from which an attribute is to be unbound. policy The name of the policy to be unbound. Example
Related Commands bind authentication vserver
enable authentication vserver

Synopsis enable authentication vserver <name>@ Description Enable a virtual authentication server. Note: Virtual servers, when added, are enabled by default. Arguments name
The name of the virtual server to be enabled. Example enable vserver authentication1 Related Commands add authentication vserver rm authentication vserver set authentication vserver unset authentication vserver disable authentication vserver show authentication vserver stat authentication vserver
disable authentication vserver

Synopsis disable authentication vserver <name>@ Description Disable (take out of service) a virtual server. Arguments name The name of the virtual server to be disabled. Notes: 1. The system still responds to ARP and/or ping requests for the IP address of this virtual server. 2. As the virtual server is still configured in the system, you can enable the virtual server using ###enable vserver### command. Example disable vserver authn_vip Related Commands add authentication vserver rm authentication vserver set authentication vserver unset authentication vserver enable authentication vserver show authentication vserver stat authentication vserver
show authentication vserver

Synopsis show authentication vserver [<name>] show authentication vserver stats - alias for 'stat authentication vserver'
Description Display all of the configured Authentication virtual servers. Arguments name The name of the authentication vserver. summary fullValues format level IPAddress The Virtual IP address of the authentication vserver. IPAddress The IP address of the authentication server. value Indicates whether or not the certificate is bound or if SSL offload is disabled. port The virtual TCP port of the authentication vserver. range The range of authentication vserver IP addresses. The new range of authentication vservers will have IP addresses consecutively numbered, starting with the primary address specified with the <ipaddress> argument. serviceType The authentication vserver's protocol type, Currently the only possible value is SSL. type The type of Virtual Server, e.g. CONTENT based or ADDRESS based. state The current state of the Virtual server, e.g. UP, DOWN, BUSY, etc. status Whether or not this vserver responds to ARPs and whether or not round-robin selection is temporarily in effect. cacheType Virtual server's cache type. The options are: TRANSPARENT, REVERSE and FORWARD. redirect The cache redirect policy. The valid redirect policies are: l. CACHE - Directs all requests to the cache. 2. POLICY - Applies cache redirection policy to determine whether the request should be directed to the cache or origin. This is the default setting. 3. ORIGIN - Directs all requests to the origin server. precedence This argument is used only when configuring content switching on the specified virtual server. This is applicable only if both the URL and RULE-based policies have been configured on the same virtual server. It specifies the type of policy (URL or RULE) that takes precedence on the content switching virtual server. The default setting is RULE. l URL - In this case, the incoming request is matched against the URL-based policies before the rule-based policies. l RULE - In this case, the incoming request is matched against the rule-based policies before the URL-based policies. For all URL-based policies, the precedence hierarchy is: 1. Domain and exact URL 2. Domain, prefix and
suffix 3. Domain and suffix 4. Domain and prefix 5. Domain only 6. Exact URL 7. Prefix and suffix 8. Suffix only 9. Prefix only 10. Default redirectURL The URL where traffic is redirected if the virtual server in system becomes unavailable. WARNING! Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the ###add cs policy### command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system. If so, the user may not get the requested content. authentication Indicates whether or not authentication is being applied to incoming users to the VPN. curAAAUsers The number of current users logged in to this vserver. AuthenticationDomain Domain of authentication vserver FQDN rule The name of the rule, or expression, if any, that policy for the authentication server is to use. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. The default rule is ns_true. policyName The name of the policy, if any, bound to the authentication vserver. serviceName The name of the service, if any, to which the vserver policy is bound. weight Weight for this service, if any. This weight is used when the system performs load balancing, giving greater priority to a specific service. It is useful when the services bound to a virtual server are of different capacity. cacheVserver The name of the default target cache virtual server, if any, to which requests are redirected. backupVServer The name of the backup vpn virtual server for this vpn virtual server. cltTimeout The idle time, if any, in seconds after which the client connection is terminated. soMethod VPN client applications are allocated from a block of Intranet IP addresses. That block may be exhausted after a certain number of connections. This switch specifies the method used to determine whether or not a new connection will spillover, or exhaust, the allocated block of Intranet IP addresses for that application. Possible values are CONNECTION or DYNAMICCONNECTION. CONNECTION means that a static integer value is the hard limit for the spillover threshold. The spillover threshold is described below. DYNAMICCONNECTION means that the spillover threshold is set according to the maximum number of connections defined for the vpn vserver. soThreshold VPN client applications are allocated from a block of Intranet IP addresses. That block may be exhausted after a certain number of connections. The value of this option is number of client connections after which the Mapped IP address is used as the client source IP address instead of an address from the allocated block of Intranet IP addresses. soPersistence
Whether or not cookie-based site persistance is enabled for this VPN vserver. Possible values are 'ConnectionProxy', HTTPRedirect, or NONE soPersistenceTimeOut The timeout, if any, for cookie-based site persistance of this VPN vserver. priority The priority, if any, of the vpn vserver policy. downStateFlush Perform delayed clean up of connections on this vserver. actType disablePrimaryOnDown Tells whether traffic will continue reaching backup vservers even after primary comes UP from DOWN state. count stateflag Example show authentication vserver
Related Commands add authentication vserver rm authentication vserver set authentication vserver unset authentication vserver enable authentication vserver disable authentication vserver stat authentication vserver
stat authentication vserver

Synopsis stat authentication vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display authentication vserver statistics. Arguments name The name of the vserver for which statistics will be displayed. If not given statistics are shown for all authentication vservers. count stateflag IP address (IP)
The IP address on which the service is running. Port (port) The port on which the service is running. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Example
Related Commands add authentication vserver rm authentication vserver set authentication vserver unset authentication vserver enable authentication vserver disable authentication vserver show authentication vserver
Chapter
9
Authorization Commands
Topics: add authorization policy rm authorization policy set authorization policy unset authorization policy show authorization policy add authorization policylabel rm authorization policylabel bind authorization policylabel unbind authorization policylabel show authorization policylabel stat authorization policylabel
266 | Citrix NetScaler 10 | Authorization Commands
add authorization policy

Synopsis add authorization policy <name> <rule> <action> Description Add an authorization policy. Authorization policies allow AAA users and AAA groups to access resources through the SSL VPN/AAA enabled vservers. By default, the SSLVPN is configured to deny access to all resources. You can alter this default action by configuring authorization policies. (You can modify the default for a SSLVPN session with a vpn session policy. See "add vpn sessionpolicy"). You can selectively alter access to some resources to DENY by binding one or more authorization policies to the AAA user or AAA group. Once bound, an authorization policy acts on all incoming AAA user resource requests. If an authorization policy rule evaluates to TRUE, the specified action (ALLOW/DENY) is applied. If the rule evaluates to FALSE, the action is not applied. You can also bind multiple authorization policies to AAA users/groups and give them different priorities. (See "bind aaa user/group".) Policies with different priorities are sorted in descending order. The following principles are applied when policies are evaluated: 1. DENY has the highest priority and takes effect immediately. 2. ALLOW has the next-highest priority. It waits for any other DENY policy in an authorization policy that has the same priority. 3. Implicit DENY has the third-highest priority. It waits for an explicit ALLOW/DENY of *any* priority. 4. Implicit ALLOW has the lowest priority. It waits for an explicit ALLOW/DENY with any priority and an Implict DENY with the same priority. Arguments name The name for the new authorization policy. rule The rule or expression for conditional evaluation of the policy. This rule can be an expression specified by "add policy expression." or it may be an inline expression. action The action to be taken when the expression is satisfied. The allowed actions are ALLOW or DENY. Example Example: Consider the following authorization policy, "author-policy", add authorization policy author-policy "URL == /*.gif" DENY bind aaa user foo -policy author-policy If the user "foo" now logs in through the SSL VPN and makes any other request except "gif", the rule will be evaluated to FALSE, and the negetion of DENY, i.e. ALLOW, will be applied. So all those resource will implicitly be allowed to access. If "foo" tries to accesss "abc.gif" this access will be denied.
Related Commands rm authorization policy set authorization policy unset authorization policy show authorization policy
rm authorization policy
Synopsis rm authorization policy <name>
Citrix NetScaler 10 | Authorization Commands | 267
Description Remove a configured authorization policy. Arguments name The name of the authorization policy to be removed. Example
Related Commands add authorization policy set authorization policy unset authorization policy show authorization policy
set authorization policy

Synopsis set authorization policy <name> [-rule <expression>] [-action <string>] Description Modify the rule or action value of a configured authorization policy. Arguments name The name of the authorization policy to be modified. rule The new rule to be associated with the authorization policy. action The new action to be associated with the authorization policy. Example
Related Commands add authorization policy rm authorization policy unset authorization policy show authorization policy
unset authorization policy

Synopsis unset authorization policy <name> [-rule] [-action]
Description Use this command to remove authorization policy settings.Refer to the set authorization policy command for meanings of the arguments. Arguments Example
Related Commands add authorization policy rm authorization policy set authorization policy show authorization policy
show authorization policy

Synopsis show authorization policy [<name>] Description Display all configured authorization policies. Arguments name The name of the authorization policy. summary fullValues format level rule Rule of the policy. action Authorization action associated with the policy. It can be either ALLOW or DENY. boundTo The entity name to which policy is bound activePolicy priority flag bindPolicyType policyType vserverType
count stateflag Example
Related Commands add authorization policy rm authorization policy set authorization policy unset authorization policy
add authorization policylabel

Synopsis add authorization policylabel <labelName> Description Add a authorization policy label. Arguments labelName Name of the authorization policy label. Example add authorization policylabel trans_http_url
Related Commands rm authorization policylabel bind authorization policylabel unbind authorization policylabel show authorization policylabel stat authorization policylabel
rm authorization policylabel
Synopsis rm authorization policylabel <labelName> Description Remove a authorization policy label. Arguments labelName Name of the authorization policy label.
Example rm authorization policylabel trans_http_url
Related Commands add authorization policylabel bind authorization policylabel unbind authorization policylabel show authorization policylabel stat authorization policylabel
bind authorization policylabel

Synopsis bind authorization policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the authorization policy to one of the labels. Arguments labelName Name of the authorization policy label. policyName The authorization policy name. Example i) bind authorization policylabel trans_http_url pol_1 1 2 -invoke reqvserver CURRENT ii) bind authorization policylabel trans_http_url pol_2 2
Related Commands add authorization policylabel rm authorization policylabel unbind authorization policylabel show authorization policylabel stat authorization policylabel
unbind authorization policylabel

Synopsis unbind authorization policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind entities from authorization label.
Arguments labelName Name of the authorization policy label. policyName The authorization policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind authorization policylabel trans_http_url pol_1 Related Commands add authorization policylabel rm authorization policylabel bind authorization policylabel show authorization policylabel stat authorization policylabel
show authorization policylabel

Synopsis show authorization policylabel [<labelName>] Description Display policy label or policies bound to authorization policylabel. Arguments labelName Name of the authorization policy label. summary fullValues format level stateflag numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The authorization policy name. priority Specifies the priority of the policy. gotoPriorityExpression
Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound authorization policy. description Description of the policylabel flags count Example i) show authorization policylabel trans_http_url ii) show authorization policylabel Related Commands add authorization policylabel rm authorization policylabel bind authorization policylabel unbind authorization policylabel stat authorization policylabel
stat authorization policylabel

Synopsis stat authorization policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of authorization policylabel(s). Arguments labelName The name of the authorization policy label for which statistics will be displayed. If not given statistics are shown for all authorization policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add authorization policylabel rm authorization policylabel bind authorization policylabel unbind authorization policylabel show authorization policylabel
Chapter
10
Base Commands
Topics: add location rm location show location add locationFile rm locationFile show locationFile add server rm server set server unset server enable server disable server show server rename server add service rm service set service unset service bind service unbind service enable service disable service show service rename service stat service add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
276 | Citrix NetScaler 10 | Base Commands
restart dbsMonitors clear locationData show servicegroupbindings stat serviceGroupMember show configstatus set locationParameter unset locationParameter show locationParameter rm vserver set vserver unset vserver enable vserver disable vserver show vserver set uiinternal unset uiinternal show uiinternal enable reporting disable reporting show reporting start nstrace stop nstrace show nstrace
Citrix NetScaler 10 | Base Commands | 277
add location
Synopsis add location <IPfrom> <IPto> <preferredLocation> [-longitude <integer> [-latitude <integer>]] Description Add Custom Location entries in the system. Arguments IPfrom The start of the IP address range in dotted notation. IPto The end of the IP address range in dotted notation. preferredLocation The qualifiers in dotted notation for the ipaddress range mentioned. longitude Longitude of the location Minimum value: -180 Maximum value: 180 latitude Latitude of the location Minimum value: -90 Maximum value: 90 Example Add location 192.168.100.1 192.168.100.100 *.us.ca.san jose Related Commands rm location show location
rm location
Synopsis rm location <IPfrom> <IPto> Description Remove a custom location entry configured in system Arguments IPfrom The start of the IP address range in dotted notation. IPto The end of the IP address range in dotted notation. Example rm location 192.168.100.1 192.168.100.100 Related Commands add location
show location
show location
Synopsis show location [<IPfrom>] Description Display custom location entries configured in the system. Arguments IPfrom The qualifiers in dotted notation for the ipaddress. If this value is not specified, all custom entries are displayed. summary fullValues format level IPto The end of the IP address range. preferredLocation The qualifiers in dotted notation for the ipaddress range. q1label Least specific location qualifier. q2label Location qualifier 2. q3label Location qualifier 3. q4label Location qualifier 4. q5label Location qualifier 5. q6label Most specific location qualifier. longitude Longitude of the location latitude Latitude of the location count stateflag Example show location
Related Commands add location rm location
add locationFile
Synopsis add locationFile <locationFile> [-format <format>] Description load static database from the specified file into the system. Arguments locationFile The name of the location file. The file name must include the full path. If the full path is not given, the default path /var/netscaler/locdb will be assumed. In high-availability mode, the static database should be stored in the same location on both systems. format The format of the location file. This optional argument is used to tell the system how to understand the file. The allowable values are: format = netscaler, ip-country, ip-country-isp, ip-country-regioncity, ip-country-region-city-isp, geoip-country, geoip-region, geoip-city, geoip-country-org, geoipcountry-isp, geoip-city-isp-org . Possible values: netscaler, ip-country, ip-country-isp, ip-countryregion-city, ip-country-region-city-isp, geoip-country, geoip-region, geoip-city, geoip-country-org, geoip-country-isp, geoip-city-isp-org Default value: NSMAP_FORMAT_NETSCALER Example add locationfile /var/nsmap/locationdb -format netscaler Related Commands rm locationFile show locationFile
rm locationFile
Synopsis rm locationFile Description Remove the location file loaded into the system. Arguments Example rm locationfile Related Commands add locationFile show locationFile
show locationFile
Synopsis show locationFile Description Display the location file loaded in the system. Arguments format level locationFile The name of the location file. format The format of the location file. Example show locationfile Related Commands add locationFile rm locationFile
add server
Synopsis add server <name>@ (<IPAddress>@ | (<domain>@ [-domainResolveRetry <integer>] [-IPv6Address ( YES | NO )]) | (-translationIp <ip_addr> -translationMask <netmask>)) [-state ( ENABLED | DISABLED )] [-comment <string>] Description Add a physical server to the system. Arguments name The server's name. IPAddress The IP address of the server. domain The domain name of the server for which a service needs to be added. If an IP Address has been specified, the domain name does not need to be specified. translationIp The IP address used for translating dns obtained ip. domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the domain name, in case the last query failed. If last query succeeds, the netscaler system waits for TTL time in the response. Default value: 5 Minimum value: 5 Maximum value: 20939 state
The initial state of the service. Possible values: ENABLED, DISABLED Default value: ENABLED IPv6Address Defines whether server is of type ipv6 or not for DBS services Possible values: YES, NO Default value: NO comment Comments associated with this server. Example add server web_serv 10.102.27.150 To add multiple servers you can use the following command: add server serv[1-3] 10.102.27.[151-153] The above command adds three servers: serv1 with IP 10.102.27.151, serv2 with IP 10.102.27.152 and serv3 with IP 10.102.27.153. Related Commands rm server set server unset server enable server disable server show server rename server
rm server
Synopsis rm server <name>@ ... Description Remove a server entry from the system. Arguments name The name of the server. Example rm server web_svr To remove the servers named serv1, serv2 and serv3 at once you can use the following command: rm server serv[1-3] Related Commands add server set server unset server enable server disable server show server rename server
set server
Synopsis set server <name>@ [-IPAddress <ip_addr|ipv6_addr|*>@ | -domainResolveRetry <integer> | -translationIp <ip_addr> | -translationMask <netmask> | -domainResolveNow] [-comment <string>] Description Set server attributes. Arguments name The name of the server. IPAddress The new IP address of the server. domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the domain name, in case the last query failed. If last query succeeds, the netscaler system waits for TTL time in the response. Default value: 5 Minimum value: 5 Maximum value: 20939 translationIp The IP address used for translating dns obtained ip. translationMask The netmask of the translation ip domainResolveNow Restart the probe for this domain based server, immediately comment Comments associated with this server. Example set server http_svr -IPAddress 10.102.1.112 To set multiple servers IP addresses at onece you can use the following command: setserver serv[1-3] -IPAddress 10.102.27.[1-3] The above command sets the IP address of serv1 to 10.102.27.1, serv2 to 10.102.27.2 and serv3 to 10.102.27.3. Related Commands add server rm server unset server enable server disable server show server rename server
unset server
Synopsis unset server <name>@ -comment
Description Use this command to remove server settings.Refer to the set server command for meanings of the arguments. Arguments Example
Related Commands add server rm server set server enable server disable server show server rename server
enable server
Synopsis enable server <name>@ Description Enable all the services under the specified server. Note: A server is enabled by default when it is added to the system. When a server is disabled, all services under the server are disabled. Arguments name The server name. Example enable server web_serv To enable all the services configured on servers named serv1, serv2 and serv3 at once, use the following command: enable server serv[1-3]
Related Commands show service enable service add server rm server set server unset server disable server show server rename server
disable server
Synopsis disable server <name>@ [<delay>] [-graceFul ( YES | NO )] Description Disable all services (that have been configured in the system) for the specified server. Arguments name The name of the server (created with the add server command) for which services will be disabled. delay The time in seconds after which all services in this server are brought down. graceFul Indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service. Possible values: YES, NO Default value: NO Example disable server web_svr 30 To disable all the services configured on servers named serv1, serv2 and serv3 at once, use the following command: disable server serv[1-3] Related Commands add service disable service add server rm server set server unset server enable server show server rename server
show server
Synopsis show server [<name> | -internal] Description View the attributes of a particular physical server. Arguments name The name of the server. When a servername is specifed, all services under the server are displayed. internal Display internally created named servers. summary
fullValues format level IPAddress The IP Address of server. state The State of the server. domain The domain name of the server. domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the domain name, in case the last query failed. If last query succeeds, the netscaler system waits for TTL time in the response. serviceName The services attatched to the server. serviceGroupName servicegroups bind to this server translationIp The IP address used for translating dns obtained ip. translationMask The netmask of the translation ip comment Comments associated with this server. stateflag stateflag serviceType The type of bound service serviceIPAddress The IP address of the bound service port The port number to be used for the bound service. svrState The state of the bound service count Example > show server web_svr1 Name: web_svr1 State:ENABLED IPAddress: 10.102.27.154 > show server web_svr1 Name: web_svr2 State:ENABLED Domain: www.abc.com Resolve Retry: 30 Secs Translation IP: 10.102.27.153 Translation Mask: 255.255.255.0 Related Commands add server rm server
set server unset server enable server disable server rename server
rename server
Synopsis rename server <name>@ <newName>@ Description Rename a server. Arguments name The name of the server. newName The new name of the server. Example rename server s1 s1-new
Related Commands add server rm server set server unset server enable server disable server show server
add service
Synopsis add service <name>@ (<IP>@ | <serverName>@) <serviceType> <port> [-clearTextPort <port>] [-cacheType <cacheType>] [-maxClient <positive_integer>] [-healthMonitor ( YES | NO )] [-maxReq <positive_integer>] [cacheable ( YES | NO )] [-cip ( ENABLED | DISABLED ) [<cipHeader>]] [-usip ( YES | NO )] [-pathMonitor ( YES | NO )] [-pathMonitorIndv ( YES | NO )] [-useproxyport ( YES | NO )] [-sc ( ON | OFF )] [-sp ( ON | OFF )] [rtspSessionidRemap ( ON | OFF )] [-cltTimeout <secs>] [-svrTimeout <secs>] [-CustomServerID <string>] [-CKA ( YES | NO )] [-TCPB ( YES | NO )] [-CMP ( YES | NO )] [-maxBandwidth <positive_integer>] [-accessDown ( YES | NO )] [-monThreshold <positive_integer>] [-state ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-tcpProfileName <string>] [-httpProfileName <string>] [-hashId <positive_integer>] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>]
Description Add a service to the system. Each server can have multiple services. Note: Each time you add a service for the same server, you must specify a unique port number for the service. Arguments name The name of the service. IP The IP address of the server for which a service will be added. serverName The name of the server for which a service will be added. serviceType The type of service. The supported protocols are: HTTP - To load balance web servers and provide connection multiplexing, latency improvement, and other content and TCP protection benefits for HTTP traffic. FTP - To load balance FTP servers. In FTP mode, the system provides TCP protection benefits, protection against SYN attacks, and surge protection. TCP - To host any other TCP protocols that are not HTTP, FTP, NNTP, or SSL. In TCP mode, the system provides TCP protection benefits, protection against SYN attack, and surge protection. UDP - To load balance servers with UDP-based services (other than DNS). SSL - To provide end-to-end encryption and SSL acceleration. SSL_BRIDGE - To load balance SSL servers. SSL_TCP - To offload SSL traffic for TCP applications. NNTP - To load balance NNTP servers. DNS - To load balance DNS servers. ADNS: To create an authoritative DNS service. ANY - To load balance a service type not listed above (for example, for IP traffic when load balancing firewalls). Note: The NNTP service is for cache redirection. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, NNTP, RPCSVR, DNS, ADNS, SNMP, RTSP, DHCPRA, ANY, SIP_UDP, DNS_TCP, ADNS_TCP, MYSQL, MSSQL, RADIUS, RDP port The port number to be used for the service. clearTextPort The clear text port number where clear text data is sent. Used with SSL offload service. Minimum value: 1 cacheType The cache type option supported by the cache server. Possible values: TRANSPARENT, REVERSE, FORWARD maxClient The maximum number of open connections to the service. Maximum value: 4294967294 healthMonitor Health monitoring state of the service. Possible values: YES, NO Default value: YES maxReq The maximum number of requests that can be sent on a persistent connection to the service. Maximum value: 65535 cacheable The virtual server (used in load balancing or content switching) routes a request to the virtual server (used in transparent cache redirection) on the same system before sending it to the configured servers. The virtual server used for transparent cache redirection determines if the request is directed to the cache servers or configured servers. Note: This argument is disabled by default. Do not specify this argument if a -cacheType cacheType is specified. Possible values: YES, NO Default value: NO cip
The Client IP header insertion option for the service. Possible values: ENABLED, DISABLED cipHeader The client IP header. If client IP insertion is enabled and the client IP header is not specified, then the value set by the ###set ns config### command will be used as the Client IP header. usip The use of client's IP Address option to the source IP Address while connecting to this server. By default, the system uses a mapped IP address for its server connection; however, you can use this option to tell the system to use the client's IP address when it communicates with the server. Possible values: YES, NO pathMonitor Path monitoring for clustering Possible values: YES, NO pathMonitorIndv Individual Path monitoring decisions Possible values: YES, NO useproxyport When USIP is enabled, based on the setting of this variable proxy port or the client port will be used as the source port for the backend connection. Possible values: YES, NO sc The state of SureConnect for the service. Note: This parameter is supported for legacy purposes only. It has no effect on this system, and its only valid value is OFF. Possible values: ON, OFF Default value: OFF sp The state of Surge protection for the the service. Possible values: ON, OFF rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. Possible values: ON, OFF Default value: OFF cltTimeout The idle time (in seconds) after which the client connection is terminated. Maximum value: 31536000 svrTimeout The idle time (in seconds) after which the server connection is terminated. Maximum value: 31536000 CustomServerID The identifier for the service. This is used when the persistency type is set to Custom Server ID. Default value: "None" serverID The identifier for the service. This is used when the persistency type is set to Custom Server ID. CKA The state of the Client Keep-Alive feature for the service. Possible values: YES, NO TCPB The state of the TCP Buffering feature for the service. Possible values: YES, NO CMP The state of the HTTP Compression feature for the service. Possible values: YES, NO maxBandwidth The maximum bandwidth in kbps allowed for the service. Maximum value: 4294967287 accessDown
The option to allow access to disabled or down services. If enabled, all packets to this service are bridged. If disabled, they are dropped. Possible values: YES, NO Default value: NO monThreshold The monitoring threshold. Maximum value: 65535 state The state of the service after it is added. Possible values: ENABLED, DISABLED Default value: ENABLED downStateFlush Perform delayed clean up of connections on this service. Possible values: ENABLED, DISABLED Default value: ENABLED tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. Minimum value: 1 comment Comments associated with this server. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. Example add service http_svc 10.102.1.112 http 80 The below command adds the service web_svc1 for the server web_serv1, web_svc2 for web_serv2 and web_svc3 for web_serv3. add service web_svc[1-3] web_serv[1-3] http 80
Related Commands rm service set service unset service bind service unbind service enable service disable service show service rename service stat service
rm service
Synopsis rm service <name>@ Description Remove a service from the system. Arguments name The name of the service. Example rm service http_svc To remove services svc1, svc2 and svc3 in one go use the following command: rm service svc[1-3] Related Commands add service set service unset service bind service unbind service enable service disable service show service rename service stat service
set service
Synopsis set service <name>@ [-IPAddress <ip_addr|ipv6_addr|*>@] [-maxClient <positive_integer>] [-maxReq <positive_integer>] [-cacheable ( YES | NO )] [-cip ( ENABLED | DISABLED ) [<cipHeader>]] [-usip ( YES | NO )] [-pathMonitor ( YES | NO )] [-pathMonitorIndv ( YES | NO )] [-useproxyport ( YES | NO )] [-sc ( ON | OFF )] [-sp ( ON | OFF )] [-rtspSessionidRemap ( ON | OFF )] [-healthMonitor ( YES | NO )] [-cltTimeout <secs>] [-svrTimeout <secs>] [-CustomServerID <string>] [-CKA ( YES | NO )] [-TCPB ( YES | NO )] [-CMP ( YES | NO )] [-maxBandwidth <positive_integer>] [-accessDown ( YES | NO )] [-monThreshold <positive_integer>] [weight <positive_integer> <monitorName>] [-downStateFlush ( ENABLED | DISABLED )] [-tcpProfileName <string>] [-httpProfileName <string>] [-hashId <positive_integer>] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] Description Use this command to modify the attributes of an existing service. Arguments name The name of the service. IPAddress The new IP address of the service. maxClient
The maximum number of open connections to the service. Maximum value: 4294967294 maxReq The maximum number of requests that can be sent on a persistent connection to the service. Maximum value: 65535 cacheable The state of cache on the service. Possible values: YES, NO Default value: NO cip The Client IP header insertion option for the service. Possible values: ENABLED, DISABLED usip The usage of Client IP Address. Possible values: YES, NO pathMonitor Path monitoring for clustering Possible values: YES, NO pathMonitorIndv Individual Path monitoring decisions Possible values: YES, NO useproxyport The usage of Client Port. Possible values: YES, NO sc The state of SureConnect for the service. Possible values: ON, OFF Default value: OFF sp The state of surge protection for the service. Possible values: ON, OFF rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. Possible values: ON, OFF Default value: OFF healthMonitor Health monitoring state of the service. Possible values: YES, NO Default value: YES cltTimeout The idle time in seconds after which the client connection is terminated. Maximum value: 31536000 svrTimeout The idle time in seconds after which the server connection is terminated. Maximum value: 31536000 CustomServerID The identifier for the service. Used when the persistency type is set to Custom Server ID. Default value: "None" serverID The identifier for the service. This is used when the persistency type is set to Custom Server ID. CKA The state of the Client Keep-Alive feature for the service. Possible values: YES, NO TCPB The state of the TCP Buffering feature for this service. Possible values: YES, NO CMP The state of the HTTP Compression feature for this service. Possible values: YES, NO maxBandwidth The maximum bandwidth in kbps allowed for this service. Maximum value: 4294967287
accessDown The option to allow access to disabled or down services. Possible values: YES, NO Default value: NO monThreshold The monitoring threshold. Maximum value: 65535 weight The weight for the specified monitor. Minimum value: 1 Maximum value: 100 downStateFlush Perform delayed clean up of connections on this service. Possible values: ENABLED, DISABLED Default value: ENABLED tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. Minimum value: 1 comment Comments associated with this service. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. Example set service http_svc -maxClient 100 The following command sets IP address 10.102.27.53 for service svc1, 10.102.27.54 for svc2 and 10.102.27.55 for svc3. set service svc[1-3] -IPAddress 10.102.27.[53-55]
Related Commands add service rm service unset service bind service unbind service enable service disable service show service rename service stat service
unset service
Synopsis unset service <name>@ [-maxClient] [-maxReq] [-cacheable] [-cip] [-usip] [-pathMonitor] [-pathMonitorIndv] [useproxyport] [-sc] [-sp] [-rtspSessionidRemap] [-CustomServerID] [-CKA] [-TCPB] [-CMP] [-maxBandwidth] [-accessDown] [-monThreshold] [-cltTimeout] [-svrTimeout] [-tcpProfileName] [-httpProfileName] [-hashId] [appflowLog] [-netProfile] [-cipHeader] [-healthMonitor] [-monitorName] [-downStateFlush] [-comment] Description Use this command to unset the attributes of an existing service..Refer to the set service command for meanings of the arguments. Arguments Example unset service http_svc -maxClient To unset maxclients for services svc1, svc2 and svc3, the following command can be used: unset service svc[1-3] -maxClient Related Commands add service rm service set service bind service unbind service enable service disable service show service rename service stat service
bind service
Synopsis bind service <name>@ -policyName <string> Description Use this command to bind a policy to a service. Notes: 1. This command does not support SureConnect policies. 2. This command only works for services that are not bound to virtual servers. If you attempt to bind a policy to a service that is already bound to a virtual server, the error message "Binding invalid policy" is displayed. Arguments name The name of the service to which the policy will be bound. policyName The DoS protection policy name must be bound to the service. Also, for DoS protection to work on a service, an appropriate policy must be bound to the service.
Example bind service svc1 -policyName pol1 To bind svc1, svc2 and svc3 to the policy pol1 you can use the following command: bind service svc[1-3] -policyName pol1 Related Commands add service rm service set service unset service unbind service enable service disable service show service rename service stat service
unbind service
Synopsis unbind service <name>@ -policyName <string> Description Unbind a policy from a service. Arguments name The name of the service. policyName Name of the policy to be unbound. Example unbind service http_svc -policyName pol1 To unbind a policy called pol1 on services svc1, svc2 and svc3, use the following command: unbind service svc[1-3] -policyName pol1 Related Commands add service rm service set service unset service bind service enable service disable service show service rename service
stat service
enable service
Synopsis enable service <name>@ Description Enable a service. Arguments name The name of the service. Example enable service http_svc To enable svc1, svc2 and svc3 in one go use the following command: enable service svc[1-3] Related Commands add service rm service set service unset service bind service unbind service disable service show service rename service stat service
disable service
Synopsis disable service <name>@ [<delay>] [-graceFul ( YES | NO )] Description Disable a service. Arguments name The name of the service that needs to be disabled. delay The time allowed (in seconds) for a graceful shutdown. During this period, new connections and requests continue to be sent to the service for clients who already have persistent sessions on the system. Connections or requests from fresh or new clients who do not yet have a persistence sessions on the NetScaler system are not sent to the service. Instead, they are load balanced among other available services. After the delay time has passed, no new requests or connections are sent to the service. graceFul
Indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service. Possible values: YES, NO Default value: NO Example disable service http_svc 10 To disable svc1, svc2 and svc3 in one go use the following command: disable service svc[1-3] 10 Related Commands add service rm service set service unset service bind service unbind service enable service show service rename service stat service
show service
Synopsis show service [<name> | -all | -internal] show service bindings Description Display the services configured on the system. This command either lists all services or displays complete information about a particular service. Arguments name The name of the service. all Display both configured and dynamically learned services. If you do not use this option, only the configured services are displayed. internal Display internally created named services. summary fullValues format level numOfconnections This will tell the number of client side connections are still open. serverName The name of the server for which a service has created. policyName
The name of the policyname for which this service is bound serviceType The type of service serviceConfTpye The configuration type of the service serviceConfType The configuration type of the service serviceConfType2 The configuration type of the service (Internal/Dynamic/Configured). port The port number to be used for the service. value SSL status. clearTextPort The clear-text port number where clear-text data is sent. Used with SSL offload service gslb The GSLB option for the corresponding virtual server. cacheType The cache type option supported by the cache server. maxClient The maximum number of open connections to the service. maxReq The maximum number of requests that can be sent on a persistent connection to the service. cacheable The virtual server (used in load balancing or content switching) routes a request to the virtual server (used in transparent cache redirection) on the same system before sending it to the configured servers. The virtual server used for transparent cache redirection determines if the request is directed to the cache servers or configured servers. Note: This argument is disabled by default. Do not specify this argument if a -cacheType cacheType is specified. cip The Client IP header insertion option for the service. cipHeader The client IP header. usip The use of client's IP Address option. pathMonitor Path monitoring for clustering pathMonitorIndv Individual Path monitoring for decisions. useproxyport The use of client's Port. sc The state of SureConnect for the service.
weight The weight of the monitor. sp The state of Surge protection for the the service. rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. failedprobes Number of the current failed monitoring probes. cltTimeout The idle time in seconds after which the client connection is terminated. totalprobes The total number of probs sent. svrTimeout The idle time in seconds after which the server connection is terminated. totalfailedprobes The total number of failed probs. publicIP public ip publicPort public port CustomServerID The identifier for the service. Used when the persistency type is set to Custom Server ID. serverID The identifier for the service. This is used when the persistency type is set to Custom Server ID. CKA The state of the Client Keep-Alive feature for the service. TCPB The state of the TCP Buffering feature for the service. CMP The state of the HTTP Compression feature for the service. maxBandwidth The maximum bandwidth in kbps allowed for the service accessDown The option to allow access to disabled or down services. If enabled, all packets to the service are bridged; if disabled, they are dropped. svrState The state of the service delay The remaining time in seconds for the service to be disabled IPAddress The IP address of the server. monitorName
The monitor Names. monThreshold The monitoring threshold. monState The configured state (enable/disable) of the monitor on this server. monState The running state of the monitor on this service. monStatCode The code indicating the monitor response. lastresponse The string form of monstatcode. responseTime Response time of this monitor. monStatParam1 First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. downStateFlush Perform delayed clean up of connections on this service. stateChangeTimeSec Time when last state change happened. Seconds part. stateChangeTimemSec Time at which last state change happened. Milliseconds part. timeSinceLastStateChange Time in milliseconds since the last state change. ticksSinceLastStateChange Time in 10 millisecond ticks since the last state change. StateUpdateReason Checks state update reason on the secondary node. ClMonOwner Tells the mon owner of the service. ClMonView Tells the view id of the monitoring owner. tcpProfileName Name of the TCP profile. httpProfileName Name of the HTTP profile. hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods.
graceFul Indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service. comment Comments associated with this service. stateflag stateflag healthMonitor Health monitoring state of the service. appflowLog Enable logging appflow flow information netProfile The name of the network profile. count Example The following is sample output of the show service -all command: 4 configured services: 1) svc1 (10.124.99.12:80) - HTTP State: UP Max Conn: 0 Max Req: 0 Use Source IP: NO Client Keepalive(CKA): NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 180 sec Server: 360 sec Client IP: DISABLED 2) svc_3 (10.100.100.3:53) DNS State: UP Max Conn: 0 Max Req: 0 Use Source IP: NO Client Keepalive(CKA): NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 180 sec Server: 360 sec Client IP: DISABLED 3) tsvc1 (77.45.32.45:80) - HTTP State: UP Max Conn: 0 Max Req: 0 Use Source IP: NO Client Keepalive(CKA): NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 180 sec Server: 360 sec Client IP: DISABLED 4) foosvc (10.124.99.13:7979) - HTTP State: UP Max Conn: 0 Max Req: 0 Use Source IP: NO Client Keepalive(CKA): NO TCP Buffering(TCPB): NO HTTP Compression(CMP): NO Idle timeout: Client: 180 sec Server: 360 sec Client IP: DISABLED Related Commands add service rm service set service unset service bind service unbind service enable service disable service rename service stat service
rename service
Synopsis rename service <name>@ <newName>@
Description Rename a service. Arguments name The name of the service. newName The new name of the service. Example rename service svc1 svcnew Related Commands add service rm service set service unset service bind service unbind service enable service disable service show service stat service
stat service
Synopsis stat service [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of a service. Arguments name Name of the service count devno stateflag Throughput (Mbps) (Throughput) Number of bytes received or sent by this service (Mbps). Average server TTFB (SvrTTFB) Average TTFB between the NetScaler appliance and the server. IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running.
Service type (Type) The service type of this service. State Current state of the server. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Current client connections (ClntConn) Number of current client connections. Requests in surge queue (SurgeQ) Number of requests in the surge queue. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state. Connections in reuse pool (ReuseP) Number of requests in the idle queue/reuse pool. Maximum server connections (MaxConn) Maximum open connections allowed on this service. Current load on the service (Load) Load on the service that is calculated from the bound load based monitor. Current flags on the service (CurtFlags) Current flags on the service for internal use in display handlers. Service hits (Hits) Number of times that the service has been provided. ActvTrans Number of active transactions handled by this service. (Including those in the surge queue.) Total Packets rcvd (PktRx) Total number of packets received by this service or virtual server. Total Packets sent (PktTx) Total number of packets sent. Example
Related Commands add service
rm service set service unset service bind service unbind service enable service disable service show service rename service stat serviceGroup stat serviceGroupMember
add serviceGroup
Synopsis add serviceGroup <serviceGroupName>@ <serviceType> [-cacheType <cacheType>] [-maxClient <positive_integer>] [-maxReq <positive_integer>] [-cacheable ( YES | NO )] [-cip ( ENABLED | DISABLED ) [<cipHeader>]] [-usip ( YES | NO )] [-pathMonitor ( YES | NO )] [-pathMonitorIndv ( YES | NO )] [-useproxyport ( YES | NO )] [-healthMonitor ( YES | NO )] [-sc ( ON | OFF )] [-sp ( ON | OFF )] [-rtspSessionidRemap ( ON | OFF )] [-cltTimeout <secs>] [-svrTimeout <secs>] [-CKA ( YES | NO )] [-TCPB ( YES | NO )] [-CMP ( YES | NO )] [-maxBandwidth <positive_integer>] [-monThreshold <positive_integer>] [-state ( ENABLED | DISABLED )] [downStateFlush ( ENABLED | DISABLED )] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] Description Add a service group to the system. Arguments serviceGroupName The name of the service group. serviceType The type of service group that is being added. Supported protocols are: HTTP - To load balance web servers and provide connection multiplexing, latency improvement, and other content and TCP protection benefits for HTTP traffic. FTP - To load balance FTP servers. In FTP mode, the NetScaler 9000 system provides TCP protection benefits, protection against SYN attacks, and surge protection. TCP - To host any other TCP protocols that are not HTTP, FTP, NNTP, or SSL. In TCP mode, the NetScaler 9000 system provides TCP protection benefits, protection against SYN attack, and surge protection UDP - To load balance servers with UDP-based service groups (other than DNS) SSL - To provide end-to-end encryption and SSL acceleration. SSL_BRIDGE - To load balance SSL servers. SSL_TCP - To offload SSL traffic for TCP applications. NNTP - To load balance NNTP servers. DNS - To load balance DNS servers. ANY - To load balance a service group type not listed above (for example, for IP traffic when load balancing firewalls). Note: The NNTP service group is for cache redirection. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, NNTP, RPCSVR, DNS, ADNS, SNMP, RTSP, DHCPRA, ANY, SIP_UDP, DNS_TCP, ADNS_TCP, MYSQL, MSSQL, RADIUS, RDP cacheType The cache type option supported by the cache server. The options are: TRANSPARENT, REVERSE, and FORWARD. Possible values: TRANSPARENT, REVERSE, FORWARD maxClient
The maximum number of open connections to each service in the service group. Maximum value: 4294967294 maxReq The maximum number of requests that can be sent over a persistent connection to a service in the service group. Maximum value: 65535 cacheable Whether a virtual server (used in the NetScaler 9000 system's load balancing or content switching feature) routes a request to the virtual server (used in transparent cache redirection) on the same NetScaler 9000 system before sending it to the configured servers. The virtual server used for transparent cache redirection determines if the request is directed to the cache servers or configured servers. Note: Do not specify this argument if a cache type is specified. This argument is disabled by default. Possible values: YES, NO Default value: NO cip Enables or disables insertion of the Client IP header for services in the service group. Possible values: ENABLED, DISABLED cipHeader The client IP header. If client IP insertion is enabled and the client IP header is not specified, then the value set by the ###set ns config### command will be used as the Client IP header. usip Enables or disables use of client's IP Address as the source IP Address while connecting to the server. By default, the system uses a mapped IP address for its server connection. However, with this option, you can tell the NetScaler 9000 system to use the client's IP address when it communicates with the server. Possible values: YES, NO pathMonitor Path monitoring for clustering Possible values: YES, NO pathMonitorIndv Individual Path monitoring decisions. Possible values: YES, NO useproxyport When USIP is enabled, based on the setting of this variable proxy port or the client port will be used as the source port for the backend connection. Possible values: YES, NO healthMonitor Health monitoring state of the all service group members. Possible values: YES, NO Default value: YES sc The state of SureConnect on this service group. Note: This parameter is supported for legacy purposes only; it has no effect, and the only valid value is OFF. Possible values: ON, OFF Default value: OFF sp Whether surge protection needs to be enabled on this service group. Possible values: ON, OFF Default value: OFF rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. Possible values: ON, OFF Default value: OFF cltTimeout The idle time in seconds after which the client connection is terminated. Maximum value: 31536000 svrTimeout
The idle time in seconds after which the server connection is terminated. Maximum value: 31536000 CKA The state of the Client Keep-Alive feature for the services in the service group. Possible values: YES, NO TCPB The state of the TCP Buffering feature for the services in the service group. Possible values: YES, NO CMP The state of the HTTP Compression feature for the services in the service group. Possible values: YES, NO maxBandwidth A positive integer that identifies the maximum bandwidth in kbps allowed for the services in the service group. Maximum value: 4294967287 monThreshold The monitoring threshold. Maximum value: 65535 state The state of the service group after it is added. Possible values: ENABLED, DISABLED Default value: ENABLED downStateFlush Perform delayed clean up of connections on this service group. Possible values: ENABLED, DISABLED Default value: ENABLED tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this servicegroup. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. Example add servicegroup http_svc_group http To add service groups sgrp1, sgrp2 and sgrp3 at one go use the following command: add servicegroup sgrp[1-3] http Related Commands rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup
disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
rm serviceGroup
Synopsis rm serviceGroup <serviceGroupName>@ Description Remove a service group. Arguments serviceGroupName The name of the service group that will be removed. Example rm servicegroup http_svc_group To remove multiple servicegroups at once, the following command can be used: rm servicegroup http_svc_group[1-3]
Related Commands add serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
set serviceGroup
Synopsis set serviceGroup <serviceGroupName>@ [(<serverName>@ <port> [-weight <positive_integer>] [-CustomServerID <string>] [-hashId <positive_integer>]) | -maxClient <positive_integer> | -maxReq <positive_integer> | -cacheable ( YES | NO ) | -cip ( ENABLED | DISABLED ) | <cipHeader> | -usip ( YES | NO ) | -sc ( ON | OFF ) | -sp ( ON | OFF ) | -rtspSessionidRemap ( ON | OFF ) | -cltTimeout <secs> | -svrTimeout <secs> | -CKA ( YES | NO ) | -TCPB ( YES | NO ) | -CMP ( YES | NO ) | -maxBandwidth <positive_integer> | -monThreshold <positive_integer> | downStateFlush ( ENABLED | DISABLED )] [-monitorName <string> -weight <positive_integer>] [-healthMonitor ( YES | NO )] [-pathMonitor ( YES | NO )] [-pathMonitorIndv ( YES | NO )] [-useproxyport ( YES | NO )]
[-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] Description Modify the attributes of an existing service group. Arguments serviceGroupName The name of the service group whose attributes will be changed. serverName The name of the server to be changed. monitorName Name of monitor bound to servicegroup, it is used in setting weight bound to monitor. maxClient The maximum number of open connections to each service in the service group. Maximum value: 4294967294 maxReq The maximum number of requests that can be sent on a persistent connection to a service. Maximum value: 65535 healthMonitor Health monitoring state of the all service group members. Possible values: YES, NO Default value: YES cacheable The state of cache on the service group. Possible values: YES, NO Default value: NO cip The state of insertion of the Client IP header for a service. Possible values: ENABLED, DISABLED usip The usage of client's IP Address Possible values: YES, NO pathMonitor Path monitoring for clustering Possible values: YES, NO pathMonitorIndv Individual Path monitoring decisions. Possible values: YES, NO useproxyport When USIP is enabled, based on the setting of this variable proxy port or the client port will be used as the source port for the backend connection. Possible values: YES, NO sc Whether SureConnect will be enabled on this service. Possible values: ON, OFF Default value: OFF sp The state of surge protection on this service group. Possible values: ON, OFF Default value: OFF rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. Possible values: ON, OFF Default value: OFF cltTimeout The idle time (in seconds) after which the client connection is terminated. Maximum value: 31536000 svrTimeout
The idle time in seconds after which the server connection is terminated. Maximum value: 31536000 CKA The state of the Client Keep-Alive feature for the service. Possible values: YES, NO TCPB The state of the TCP Buffering feature for this service. Possible values: YES, NO CMP The state of the HTTP Compression feature for this service. Possible values: YES, NO maxBandwidth A positive integer that identifies the maximum bandwidth in kbps allowed for this service. Maximum value: 4294967287 monThreshold The monitoring threshold. Maximum value: 65535 downStateFlush Perform delayed cleanup of connections on this service group. Possible values: ENABLED, DISABLED Default value: ENABLED tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this servicegroup. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. Example set servicegroup http_svc_group -maxClient 100 To set the attribute maxclient for multiple servicegroups at once, use the following command: set servicegroup http_svc_group[1-3] maxClient 100 Related Commands add serviceGroup rm serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup
rename serviceGroup
unset serviceGroup
Synopsis unset serviceGroup <serviceGroupName>@ [(<serverName>@ <port> [-weight] [-CustomServerID] [-hashId]) | -maxClient | -maxReq | -cacheable | -cip | -usip | -sc | -sp | -rtspSessionidRemap | -cltTimeout | -svrTimeout | CKA | -TCPB | -CMP | -maxBandwidth | -monThreshold] [-useproxyport] [-tcpProfileName] [-httpProfileName] [-appflowLog] [-netProfile] [-monitorName] [-healthMonitor] [-cipHeader] [-pathMonitor] [-pathMonitorIndv] [downStateFlush] [-comment] Description Use this command to unset the attributes of an existing service group..Refer to the set serviceGroup command for meanings of the arguments. Arguments Example unset servicegroup http_svc_group -maxClient Related Commands add serviceGroup rm serviceGroup set serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
bind serviceGroup
Synopsis bind serviceGroup <serviceGroupName> (<IP>@ | <serverName>@) <port> [-weight <positive_integer>] [CustomServerID <string>] [-state ( ENABLED | DISABLED )] [-hashId <positive_integer>] [-autoScale ( YES | NO )] Description Bind a service to a service group. Arguments serviceGroupName The name of the service group to which the service will be bound. IP The IP address of a member to be added. serverName The name of the server that hosts the member. port
The port number of a service to be added. weight Weight for this service. This weight is used when the system performs load balancing. It is useful to specify weights when services bound to the service group have different capacities. Default value: 1 Minimum value: 1 Maximum value: 100 CustomServerID A positive integer that will identify the service. Used when the persistency type is set to Custom Server ID. Default value: "None" serverID The identifier for the service. This is used when the persistency type is set to Custom Server ID. state The state of the IP/Port after binding. Possible values: ENABLED, DISABLED Default value: ENABLED hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. Minimum value: 1 autoScale Auto scale option for a domain based server when bound to a servicegroup Possible values: YES, NO Default value: NO Example bind servicegroup http_svc_group 10.102.27.153 80 To bind multiple servers to a servicegroup, following command can be used: bind servicegroup http_svc_group 10.102.27.[153-155] 80 Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
unbind serviceGroup
Synopsis unbind serviceGroup <serviceGroupName> (<IP>@ | <serverName>@) <port> Description Unbind a service from a service group. Arguments serviceGroupName The name of the service group.
IP The IP address of a member to be removed. serverName The name of the server that hosts the member to be unbound from the service group. port The port number of a service to be unbound from the service group. Example unbind servicegroup http_svc_group 10.102.27.153 80 To unbind multiple servers following command can be used: unbind servicegroup http_svc_group 10.102.27.[153-155] 80 Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
enable serviceGroup
Synopsis enable serviceGroup <serviceGroupName>@ [<serverName>@ <port>] Description Use this command to enable a service group. Arguments serviceGroupName The name of the service group to be enabled. serverName The name of the server that hosts the member to be enabled from the service group. port The port number of the service to be enabled. Example enable servicegroup http_svc_group To enable multiple service groups at one go use the following command: enable servicegroup http_svc_group[1-3] Related Commands add serviceGroup rm serviceGroup
set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup disable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
disable serviceGroup
Synopsis disable serviceGroup <serviceGroupName>@ [<serverName>@ <port>] [-delay <secs>] [-graceFul ( YES | NO )] Description Use this command to disable a service group. Arguments serviceGroupName The name of the service group that needs to be disabled. serverName The name of the server that hosts the member to be disabled from the service group. port The port number of the service to be disabled. delay The time allowed (in seconds) for a graceful shutdown. During this period, new connections or requests will continue to be sent to this service for clients who already have a persistent session on the system. Connections or requests from fresh or new clients who do not yet have a persistence sessions on the system will not be sent to the service. Instead, they will be load balanced among other available services. After the delay time expires, no new requests or connections will be sent to the service. graceFul Indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service. Possible values: YES, NO Default value: NO Example disable servicegroup http_svc_group 10.102.27.153 80 -delay 10 To disable multiple servicegroups use the following command: disable servicegroup http_svc_group[1-3] 10.102.27. [153-155] 80 -delay 30 Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup
enable serviceGroup show serviceGroup stat serviceGroup rename serviceGroup
show serviceGroup
Synopsis show serviceGroup [<serviceGroupName> | -includeMembers] Description Display the configured service groups. This command either lists all service groups or displays complete information about a particular service group. Arguments serviceGroupName The name of the service group. includeMembers Include a summary of the members in a group too. summary fullValues format level numOfconnections This will tell the number of client side connections are still open. serviceType The type of service group that is being added. Supported protocols are: HTTP - To load balance web servers and provide connection multiplexing, latency improvement, and other content and TCP protection benefits for HTTP traffic. FTP - To load balance FTP servers. In FTP mode, the NetScaler 9000 system provides TCP protection benefits, protection against SYN attacks, and surge protection. TCP - To host any other TCP protocols that are not HTTP, FTP, NNTP, or SSL. In TCP mode, the NetScaler 9000 system provides TCP protection benefits, protection against SYN attack, and surge protection UDP - To load balance servers with UDP-based service groups (other than DNS) SSL - To provide end-to-end encryption and SSL acceleration. SSL_BRIDGE - To load balance SSL servers. SSL_TCP - To offload SSL traffic for TCP applications. NNTP - To load balance NNTP servers. DNS - To load balance DNS servers. ANY - To load balance a service group type not listed above (for example, for IP traffic when load balancing firewalls). Note: The NNTP service group is for cache redirection. port The port number of the service to be enabled. serviceConfTpye serviceConfType The configuration type of the service group. value SSL Status. cacheType
The cache type option supported by the cache server. The options are: TRANSPARENT, REVERSE, and FORWARD. maxClient The maximum number of open connections to each service in the service group. maxReq The maximum number of requests that can be sent over a persistent connection to a service in the service group. cacheable The state of cache on the service. cip Enables or disables insertion of the Client IP header for services in the service group. cipHeader CIP Header. usip Enables or disables use of client's IP Address as the source IP Address while connecting to the server. By default, the system uses a mapped IP address for its server connection. However, with this option, you can tell the NetScaler 9000 system to use the client's IP address when it communicates with the server. pathMonitor Path monitoring for clustering pathMonitorIndv Individual Path monitoring decisions. useproxyport The use of client's Port. monweight weight of the monitor that is bound to servicegroup. sc Whether SureConnect is enabled on this service or not. sp Whether surge protection needs to be enabled on this service group. rtspSessionidRemap Use this parameter to enable mapping of RTSP sessionid. cltTimeout The idle time in seconds after which the client connection is terminated. svrTimeout The idle time in seconds after which the server connection is terminated. CKA The state of the Client Keep-Alive feature for the services in the service group. TCPB The state of the TCP Buffering feature for the services in the service group. CMP The state of the HTTP Compression feature for the services in the service group. maxBandwidth
A positive integer that identifies the maximum bandwidth in kbps allowed for the services in the service group. state The state of the service group svrState The state of the service delay The remaining time in seconds for the service to be disabled IP IP Address. serverName The name of the server to be changed. monitorName Monitor name. monThreshold The monitoring threshold. monState Monitor state. weight CustomServerID The identifier for this IP:Port pair. Used when the persistency type is set to Custom Server ID. serverID The identifier for the service. This is used when the persistency type is set to Custom Server ID. monState The running state of the monitor on this service. monStatCode The code indicating the monitor response. monStatParam1 First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. downStateFlush Perform delayed cleanup of connections on this vserver. stateChangeTimeSec Time when last state change occurred. Seconds part. stateChangeTimemSec Time when last state change occurred. Milliseconds part. timeSinceLastStateChange Time in milliseconds since the last state change. ticksSinceLastStateChange
Time in 10 millisecond ticks since the last state change. StateUpdateReason Checks state update reason on the secondary node. ClMonOwner Tells the mon owner of the service. ClMonView Tells the view id of the monitoring owner. groupCount Servicegroup Count comment Comments associated with this servicegroup. tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. graceFul Indicates graceful shutdown of the service. System will wait for all outstanding connections to this service to be closed before disabling the service. healthMonitor Health monitoring state of the all service group members. appflowLog Enable logging appflow flow information netProfile The name of the network profile. autoScale Auto scale option for a domain based server when bound to a servicegroup count stateflag Example
Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup
disable serviceGroup stat serviceGroup rename serviceGroup
stat serviceGroup
Synopsis stat serviceGroup [<serviceGroupName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of service group(s). Arguments serviceGroupName The name of a service group count devno stateflag State Current state of the server. Service type (Type) The service type of this service. Example Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup rename serviceGroup stat service stat serviceGroupMember
rename serviceGroup
Synopsis rename serviceGroup <serviceGroupName>@ <newName>@
Description Rename a service group. Arguments serviceGroupName The name of the service group. newName The new name of the service group. Example rename service svcgrp1 svcgrp-new1
Related Commands add serviceGroup rm serviceGroup set serviceGroup unset serviceGroup bind serviceGroup unbind serviceGroup enable serviceGroup disable serviceGroup show serviceGroup stat serviceGroup
restart dbsMonitors
Synopsis restart dbsMonitors Description Use this command to clear/flush all learnt ip addresses for domain based servers Arguments Example restart dbsMonitors
Related Commands
clear locationData
Synopsis clear locationData
Description Clear all location information, including custom entries and static database entries. Arguments Example clear locationdata
Related Commands
show servicegroupbindings
Synopsis show servicegroupbindings <serviceGroupName> Description Display the services configured on the system. This command either lists all services or displays complete information about a particular service. Arguments serviceGroupName The name of the service. IPAddress The IP address of the vserver. port The port of the vserver. state The state of the service group svrState The state of the vserver vServerName The name of the vserver. stateflag count Example
Related Commands
stat serviceGroupMember
Synopsis stat serviceGroupMember <serviceGroupName> (<IP> | <serverName>) <port> [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>]
Description Display statistics of a service group member. Arguments serviceGroupName The name of a service group IP The IP address of the member serverName The name of the Domain based server for which stats are required port The port number of the member count devno stateflag Average server TTFB (SvrTTFB) Average TTFB between the NetScaler appliance and the server. IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running. Service type (Type) The service type of this service. State Current state of the server. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Current client connections (ClntConn) Number of current client connections. Requests in surge queue (SurgeQ) Number of requests in the surge queue. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state.
Connections in reuse pool (ReuseP) Number of requests in the idle queue/reuse pool. Maximum server connections (MaxConn) Maximum open connections allowed on this service. Example Related Commands stat service stat serviceGroup
show configstatus
Synopsis show configstatus Description Display status of packet engines. Arguments consistent State of packet engines. culpritCore Culprit core id. core Core id. culpritCoreConfString coreConfString count stateflag Example show configstatus Related Commands
set locationParameter
Synopsis set locationParameter [-context ( geographic | custom )] [-q1label <string>] [-q2label <string>] [-q3label <string>] [q4label <string>] [-q5label <string>] [-q6label <string>] Description This command specifies the location parameters used for static proximity based load balancing. Arguments context The context in which a static proximity decision has to be made. Possible values: geographic, custom
q1label The label for the 1st qualifier. These qualifier labels specify the locations mapped with the IP addresses used to make static proximity decisions. q2label The label for the 2nd qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q3label The label for the 3rd qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q4label The label for the 4th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q5label The label for the 5th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q6label The label for the 6th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. Example set locationparameter -context custom Related Commands unset locationParameter show locationParameter
unset locationParameter
Synopsis unset locationParameter [-context] [-q1label] [-q2label] [-q3label] [-q4label] [-q5label] [-q6label] Description Use this command to remove locationParameter settings.Refer to the set locationParameter command for meanings of the arguments. Arguments Example
Related Commands set locationParameter show locationParameter
show locationParameter
Synopsis show locationParameter
Description Display information about the context and qualifier labels used for static proximity based load balancing. Arguments format level context The context in which a static proximity decision must be made. q1label The label for the 1st qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q2label The label for the 2nd qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q3label The label for the 3rd qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q4label The label for the 4th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q5label The label for the 5th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. q6label The label for the 6th qualifier. These qualifier labels characterize the locations mapped with the IP addresses used to make static proximity decisions. locationFile Currently loaded location database file. format custom Number of configured custom locations. static Number of configured locations in the database file (static locations). lines Number of lines in the databse files errors Number of errros encountered while reading the database file. warnings Number of warnings encountered while reading the database file. entries Number of successfully added entries. flags Information needed for display. This argument passes information from the kernel to the user space. status
This argument displays when the status (success or failure) of database loading. Example show locationparameter Related Commands set locationParameter unset locationParameter
rm vserver
Synopsis Description Use this command to remove a virtual server. NOTE: This command is deprecated.This command is deprecated in 10.0, instead you can use commands such as rm lb vserver Arguments name The name of the virtual server to be removed. Example rm vserver lb_vip To remove multiple vservers, use the following command: rm vserver lb_vip[1-3] Related Commands set vserver unset vserver enable vserver disable vserver show vserver
set vserver
Synopsis Description Use this command to modify the parameters for an existing virtual server. NOTE: This command is deprecated.This command is deprecated in 10.0, instead you can use commands such as set lb vserver Arguments name The name of the virtual server for which the parameters are to be set. backupVServer The name of the backup virtual server for this virtual server. redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. cacheable
Use this option to specify whether a virtual server (used for load balancing or content switching) routes requests to the cache redirection virtual server before sending it to the configured servers. Possible values: YES, NO cltTimeout The timeout value in seconds for idle client connection Maximum value: 31536000 soMethod The spillover factor. The system will use this value to determine if it should send traffic to the backupvserver when the main virtual server reaches the spillover threshold. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The spillover persistence entry timeout. Default value: 2 Minimum value: 2 Maximum value: 1440 soThreshold The spillver threshold value. Minimum value: 1 Maximum value: 4294967294 pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. Example set vserver lb_vip -backupVServerName bkvip_lbvip To set backup vserver for multiple vservers at once, use the following command: set vserver lb_vip[1-3] -backupVServerName bkvip_lbvip Related Commands rm vserver unset vserver enable vserver disable vserver show vserver
unset vserver
Synopsis Description Use this command to unset the backup virtual server or the redirectURL that has been set on the virtual server..Refer to the set vserver command for meanings of the arguments.NOTE: This command is deprecated. Arguments Example unset vserver lb_vip -backupVServer To unset the backup vserver for multiple vservers use the following command: unset vserver lb_vip[1-3] -backupVServer Related Commands rm vserver
set vserver enable vserver disable vserver show vserver
enable vserver
Synopsis Description Use this command to enable a virtual server. Note: Virtual servers, when added, are enabled by default. NOTE: This command is deprecated.This command is deprecated in 10.0, instead you can use commands such as enable lb vserver Arguments name The name of the virtual server to be enabled. Example enable vserver lb_vip To enable multiple vservers, use the following command: enable vserver lb_vip[1-3] Related Commands rm vserver set vserver unset vserver disable vserver show vserver
disable vserver
Synopsis Description Use this command to disable (take out of service) a virtual server. NOTE: This command is deprecated.This command is deprecated in 10.0, instead you can use commands such as disable lb vserver Arguments name The name of the virtual server to be disabled. Notes: 1. The system will continue to respond to ARP and/or ping requests for the IP address of this virtual server. 2. As the virtual server is still configured in the system, you can enable the virtual server using the ###enable vserver### command. Example disable vserver lb_vip To disable multiple vservers, use the following command: disable vserver lb_vip[1-3]
Related Commands rm vserver set vserver unset vserver enable vserver show vserver
show vserver
Synopsis show vserver [<name>] Description Use this command to display all virtual servers configured on the NetScaler system. The information displayed includes the virtual server name, IP address, port number, service type, virtual server state and virtual server type. Arguments name The name of the virtual server (created with the add vserver command) for which the details will be displayed. summary fullValues format level insertVserverIPPort The virtual IP and port header insertion option for the vserver. vipHeader The name of the virtual IP and port header. IPAddress IPAddress The IP address of the virtual server. port range IPv6Address IPPattern The IP pattern of the virtual server. IPMask The IP address mask of the virtual server. serviceType value type state
effectiveState status cacheType redirect precedence redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. authentication homePage dnsVserverName domain rule policyName hits serviceName weight cacheVserver backupVServer The name of the backup virtual server for this virtual server. priority cltTimeout The timeout value in seconds for idle client connection soMethod The spillover factor. The system will use this value to determine if it should send traffic to the backupvserver when the main virtual server reaches the spillover threshold. soPersistence spill over persistence soPersistenceTimeOut spill over persistence timeout soThreshold spill over persistence threshold lbMethod lb method hashLength max hash length dataOffset data offset dataLength
data length netmask hash netmask groupName group name m lb mode tosId TOS ID persistenceType cookieDomain domain name persistMask persistence mask persistenceBackup backup persistence type timeout timeout cacheable cacheablity pq number sc The state of SureConnect on this vserver. sessionless sessionless lb url URL for probe reuse wtm destinationVServer destination vserver via via flags vserver flags connfailover connection failover caseSensitive persistence type map map
redirectPortRewrite port rewrite for ssl downStateFlush Perform delayed clean up of connections on this vserver. cookieIpPort Encryped Ip address and port of the service that is inserted into the set-cookie http header vserverId Vserver Id version Cookie version totalServices Total number of services bound to the vserver. activeServices Total number of active services bound to the vserver. count stateflag Example show vserver lb_vip Related Commands rm vserver set vserver unset vserver enable vserver disable vserver
set uiinternal
Synopsis set uiinternal <entityType> <name> [-template <string>] [-comment <string>] [-rule <string>] Description set uiinternal data for the entities Arguments entityType The entitiy type of UI internal data Possible values: LBVSERVER, GSLBVSERVER, CRVSERVER, VPNVSERVER, CSVSERVER, AUTHENTICATIONVSERVER, SERVER, SERVICE, SERVICEGROUP, GSLBSERVICE, EXPRESSION, VPNURL name The entity name template The application template associated with entity comment
The application template associated with entity rule rules associated with entity Example set uiinternal lbvserver v1 -template app1 Related Commands unset uiinternal show uiinternal
unset uiinternal
Synopsis unset uiinternal <entityType> <name> [-template] [-comment] [-rule] [-all] Description unset uiinternal for the entities.Refer to the set uiinternal command for meanings of the arguments. Arguments Example unset uiinternal lbvserver v1 -template app1 Related Commands set uiinternal show uiinternal
show uiinternal
Synopsis show uiinternal [<entityType>] [<name>] Description display all UI internal data information for the entities Arguments entityType The entitiy type of UI internal data Possible values: LBVSERVER, GSLBVSERVER, CRVSERVER, VPNVSERVER, CSVSERVER, AUTHENTICATIONVSERVER, SERVER, SERVICE, SERVICEGROUP, GSLBSERVICE, EXPRESSION, VPNURL name The entity name summary fullValues format level template The template associated with the entity
comment The comment associated with the entity uiinfo The uiinfo associated with the entity rule The rule associated with the entity count stateflag Example show uiinternal LBVSERVER v1 Related Commands set uiinternal unset uiinternal
enable reporting
Synopsis enable reporting Description Enable the data collection for reporting module. Arguments Example enable reporting Related Commands disable reporting show reporting
disable reporting
Synopsis disable reporting Description Disable the data collection for reporting module. Arguments Example disable reporting Related Commands enable reporting show reporting
show reporting
Synopsis show reporting Description show the state of data collection for reporting module. Arguments state The rule associated with the entity Example show reporting Related Commands enable reporting disable reporting
start nstrace
Synopsis start nstrace [-nf <positive_integer>] [-time <positive_integer>] [-size <positive_integer>] [-mode <mode> ...] [tcpdump ( ENABLED | DISABLED )] [-perNIC ( ENABLED | DISABLED )] [-fileName <string>] [-fileId <string>] [-filter <expression>] [-link ( ENABLED | DISABLED )] [-nodes <positive_integer> ...] Description Start NetScaler packet capture tool. Arguments nf Number of files to be generated in cycle. Default value: 24 Minimum value: 1 Maximum value: 100 time Time per file (sec). Default value: 3600 Minimum value: 1 size Size of the captured data. Set 0 for full packet trace. Default value: 164 Maximum value: 1514 mode Capturing mode for trace. Mode can be any of the following values or combination of these values: RX Received packets before NIC pipelining NEW_RX Received packets after NIC pipelining TX Transmitted packets TXB Packets buffered for transmission IPV6 Translated IPv6 packets C2C Capture C2C message NS_FR_TX TX/TXB packets are not captured in flow receiver. Default mode: NEW_RX TXB Default value: DEFAULT_MODE tcpdump Trace is captured in TCPDUMP(.pcap) format. Default capture format is NSTRACE(.cap). Possible values: ENABLED, DISABLED Default value: DISABLED perNIC Use separate trace files for each interface. Works only with tcpdump format. Possible values: ENABLED, DISABLED Default value: DISABLED fileName Name of the trace file. fileId
ID for the trace file name for uniqueness. Should be used only with -name option. filter Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format: <expression> [<relop> <expression>] <relop> = ( && | || ) nstrace supports two types of filter expressions: Classic Expressions: <expression> = the expression string in the format: <qualifier> <operator> <qualifier-value> <qualifier> = SOURCEIP. <qualifier-value> = A valid IP address <qualifier> = SOURCEPORT. <qualifier-value> = A valid port number. <qualifier> = DESTIP. <qualifier-value> = A valid IP address. <qualifier> = DESTPORT. <qualifier-value> = A valid port number. <qualifier> = IP. <qualifier-value> = A valid IP address. <qualifier> = PORT. <qualifier-value> = A valid port number. <qualifier> = SVCNAME. <qualifier-value> = The name of a service. <qualifier> = VSVRNAME. <qualifier-value> = The name of a vserver. <qualifier> = CONNID <qualifier-value> = A valid PCB dev number. <qualifier> = VLAN <qualifier-value> = A valid VLAN ID. <qualifier> = INTF <qualifier-value> = A valid interface id in the form of x/y (n/x/y in case of cluster interface). <operator> = ( == | eq | != | neq | > | gt | < | lt | >= | ge | <= | le | BETWEEN ) eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)" The filter expression should be given in double quotes. Default Expressions: <expression> =: CONNECTION.<qualifier>.<qualifiermethod>.(<qualifier-value>) <qualifier> = SRCIP <qualifier-method> = [ EQ | NE ] <qualifiervalue> = A valid IPv4 address. example = CONNECTION.SRCIP.EQ(127.0.0.1) <qualifier> = DSTIP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.DSTIP.EQ(127.0.0.1) <qualifier> = IP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.IP.EQ(127.0.0.1) <qualifier> = SRCIPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1) <qualifier> = DSTIPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1) <qualifier> = IPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1) <qualifier> = SRCPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.SRCPORT.EQ(80) <qualifier> = DSTPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.DSTPORT.EQ(80) <qualifier> = PORT <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid port number. example = CONNECTION.PORT.EQ(80) <qualifier> = VLANID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifiervalue> = A valid vlan ID. example = CONNECTION.VLANID.EQ(0) <qualifier> = CONNID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid PCB dev number. example = CONNECTION.CONNID.EQ(0) <qualifier> = PPEID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid core ID. example = CONNECTION.PPEID.EQ(0) <qualifier> = SVCNAME <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH | ENDSWITH ] <qualifier-value> = A valid text string. example = CONNECTION.SVCNAME.EQ("name") <qualifier> = INTF <qualifiermethod> = [ EQ | NE ] <qualifier-value> = A valid interface id in the form of x/y. example = CONNECTION.INTF.EQ("x/y") eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))" The filter expression should be given in double quotes. link Includes filtered connection's peer traffic. Possible values: ENABLED, DISABLED Default value: DISABLED nodes Nodes on which tracing is started. Maximum value: 32 Example start nstrace -time 10
Related Commands stop nstrace show nstrace
stop nstrace
Synopsis stop nstrace Description Stop running NetScaler packet capture tool. Arguments Example stop nstrace Related Commands start nstrace show nstrace
show nstrace
Synopsis show nstrace Description Display nstrace parameters set through 'start nstrace' command. Arguments state Current running state of trace. scope Scope of started trace, local or cluster level. traceLocation Directory where current trace files are saved. nf Number of files to be generated in cycle. time Time per file (sec). size Size of the captured data. Set 0 for full packet trace. mode Capturing mode for trace. Mode can be any of the following values or combination of these values: RX Received packets before NIC pipelining NEW_RX Received packets after NIC pipelining TX Transmitted packets TXB Packets buffered for transmission IPV6 Translated IPv6 packets C2C Capture C2C message NS_FR_TX TX/TXB packets are not captured in flow receiver. Default mode: NEW_RX TXB tcpdump Trace is captured in TCPDUMP(.pcap) format. Default capture format is NSTRACE(.cap).
perNIC Use separate trace files for each interface. Works only with tcpdump format. fileName Name of the trace file. fileId ID for the trace file name for uniqueness. Should be used only with -name option. filter Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format: <expression> [<relop> <expression>] <relop> = ( && | || ) nstrace supports two types of filter expressions: Classic Expressions: <expression> = the expression string in the format: <qualifier> <operator> <qualifier-value> <qualifier> = SOURCEIP. <qualifier-value> = A valid IP address <qualifier> = SOURCEPORT. <qualifier-value> = A valid port number. <qualifier> = DESTIP. <qualifier-value> = A valid IP address. <qualifier> = DESTPORT. <qualifier-value> = A valid port number. <qualifier> = IP. <qualifier-value> = A valid IP address. <qualifier> = PORT. <qualifier-value> = A valid port number. <qualifier> = SVCNAME. <qualifier-value> = The name of a service. <qualifier> = VSVRNAME. <qualifier-value> = The name of a vserver. <qualifier> = CONNID <qualifier-value> = A valid PCB dev number. <qualifier> = VLAN <qualifier-value> = A valid VLAN ID. <qualifier> = INTF <qualifier-value> = A valid interface id in the form of x/y (n/x/y in case of cluster interface). <operator> = ( == | eq | != | neq | > | gt | < | lt | >= | ge | <= | le | BETWEEN ) eg: start nstrace -filter "SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80)" The filter expression should be given in double quotes. Default Expressions: <expression> =: CONNECTION.<qualifier>.<qualifiermethod>.(<qualifier-value>) <qualifier> = SRCIP <qualifier-method> = [ EQ | NE ] <qualifiervalue> = A valid IPv4 address. example = CONNECTION.SRCIP.EQ(127.0.0.1) <qualifier> = DSTIP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.DSTIP.EQ(127.0.0.1) <qualifier> = IP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.IP.EQ(127.0.0.1) <qualifier> = SRCIPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.SRCIPv6.EQ(2001:db8:0:0:1::1) <qualifier> = DSTIPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.DSTIPv6.EQ(2001:db8:0:0:1::1) <qualifier> = IPv6 <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv6 address. example = CONNECTION.IPv6.EQ(2001:db8:0:0:1::1) <qualifier> = SRCPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.SRCPORT.EQ(80) <qualifier> = DSTPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.DSTPORT.EQ(80) <qualifier> = PORT <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid port number. example = CONNECTION.PORT.EQ(80) <qualifier> = VLANID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifiervalue> = A valid vlan ID. example = CONNECTION.VLANID.EQ(0) <qualifier> = CONNID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid PCB dev number. example = CONNECTION.CONNID.EQ(0) <qualifier> = PPEID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid core ID. example = CONNECTION.PPEID.EQ(0) <qualifier> = SVCNAME <qualifier-method> = [ EQ | NE | CONTAINS | STARTSWITH | ENDSWITH ] <qualifier-value> = A valid text string. example = CONNECTION.SVCNAME.EQ("name") <qualifier> = INTF <qualifiermethod> = [ EQ | NE ] <qualifier-value> = A valid interface id in the form of x/y. example = CONNECTION.INTF.EQ("x/y") eg: start nstrace -filter "CONNECTION.SRCIP.EQ(127.0.0.1) || (CONNECTION.SVCNAME.NE("s1") && CONNECTION.SRCPORT.EQ(80))" The filter expression should be given in double quotes. link Includes filtered connection's peer traffic. nodes
Nodes on which tracing is started. Example show nstrace
Related Commands start nstrace stop nstrace
Chapter
11
Integrated Caching Commands
Topics: stat cache add cache policy rm cache policy set cache policy unset cache policy show cache policy stat cache policy rename cache policy add cache policylabel rm cache policylabel bind cache policylabel unbind cache policylabel show cache policylabel stat cache policylabel rename cache policylabel add cache contentGroup rm cache contentGroup set cache contentGroup unset cache contentGroup show cache contentGroup expire cache contentGroup flush cache contentGroup add cache forwardProxy rm cache forwardProxy show cache forwardProxy add cache selector rm cache selector set cache selector show cache selector show cache object expire cache object flush cache object show cache stats bind cache global unbind cache global show cache global
340 | Citrix NetScaler 10 | Integrated Caching Commands
set cache parameter unset cache parameter show cache parameter
Citrix NetScaler 10 | Integrated Caching Commands | 341
stat cache
Synopsis stat cache [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display the Integrated Cache statistics. Arguments Maximum memory(KB) Deprecated (MaxMem) Largest amount of memory the NetScaler can dedicate to caching, up to 50% of available memory. A 0 value disables caching, but the caching module continues to run. Recent successful reval ratio(%) (RPSucRev) Recently recorded percentage of times stored content was successfully revalidated by a 304 response rather than by a full response Recent storable miss ratio(%) (RPctStMis) Recently recorded ratio of store-able misses to all misses expressed as percentage. Recent parameterized 304 hit ratio(%) (RPPHit) Recently recorded ratio of parameterized 304 hits to all parameterized hits expressed as a percentage Recent origin bandwidth saved(%) (RPOrBan) Bytes served from cache divided by total bytes served to client. This ratio can be greater than 1 because of the assumption that all compression has been done in the NetScaler. Recent hit ratio(%) (RPctHit) Recently recorded cache hit ratio expressed as percentage Recent byte hit ratio(%) (RPcByHit) Recently recorded cache byte hit ratio expressed as percentage. Here we define byte hit ratio as ((number of bytes served from the cache)/(total number of bytes served to the client)). This is the standard definition of Byte Hit Ratio. If compression is turned ON in NS then this ratio doesn't mean much. This might under or over estimate the origin-to-cache bandwidth saving (depending upon whether bytes served by CMP in NetScaler are more or less than compressed bytes served from the cache). If CMP is turned OFF in NS then this ratio is same as cacheRecentPercentOriginBandwidthSaved. Recent 304 hit ratio(%) (RPct304Hit) Recently recorded ratio of 304 hits to all hits expressed as percentage Utilized memory(KB) (UtiMem) Amount of memory the integrated cache is currently using. Maximum memory active value(KB) (MaxMemActive) Currently active value of maximum memory Maximum memory(KB) (Max64Mem) Largest amount of memory the NetScaler can dedicate to caching, up to 50% of available memory. A 0 value disables caching, but the caching module continues to run. Poll every time hit ratio(%) (PPeHit) Percentage of cache hits in content groups that have Poll Every Time enabled, relative to all searches of content groups with Poll Every Time enabled. Poll every time hits (PeHit) Number of times a cache hit was found during a search of a content group that has Poll Every Time enabled.
Parameterized 304 hit ratio(%) (PP304Hit) Percentage of parameterized 304 hits relative to all parameterized hits. Total parameterized hits (PHit) Parameterized requests resulting in either a 304 or non-304 hit. Successful reval ratio(%) (PSucRev) Percentage of times stored content was successfully revalidated by a 304 (Object Not Modifed) response rather than by a full response Storable miss ratio(%) (PStrMiss) Responses that were fetched from the origin, stored in the cache, and then served to the client, as a percentage of all cache misses. Conversions to conditional req (FuToCon) Number of user-agent requests for a cached Poll Every Time (PET) response that were sent to the origin server as conditional requests. Successful revalidations (TSucRev) Total number of times stored content was successfully revalidated by a 304 Not Modified response from the origin. Revalidations (Reval) Responses that an intervening cache revalidated with the integrated cache before serving, as determined by a Cache-Control: Max-Age header configurable in the integrated cache Non-storable misses (NStrMiss) Cache misses for which the fetched response is not stored in the cache. These responses match policies with a NOCACHE action or are affected by Poll Every Time. Storable misses (StrMiss) Cache misses for which the fetched response is stored in the cache before serving it to the client. Storable misses conform to a built-in or user-defined caching policy that contains a CACHE action. Compressed bytes from cache (CmpBySer) Number of compressed bytes served from the cache Byte hit ratio(%) (PByHit) Bytes served from the cache divided by total bytes served to the client. If compression is On in the NetScaler, this ratio may not reflect the bytes served by the compression module. If the compression is Off, this ratio is the same as cachePercentOriginBandwidthSaved. Bytes served by cache (BySer) Total number of bytes served from the integrated cache Bytes served by NetScaler (RespBy) Total number of HTTP response bytes served by NetScaler from both the origin and the cache 304 hit ratio(%) (Pct304Hit) 304 responses as a percentage of all responses that the NetScaler served. Marker objects (NumMark) Marker objects created when a response exceeds the maximum or minimum size for entries in its content group or has not yet received the minimum number of hits required for items in its content group. Origin bandwidth saved(%) (POrBan) Percentage of origin bandwidth saved, expressed as number of bytes served from the integrated cache divided by all bytes served. The assumption is that all compression is done in the NetScaler. Hit ratio(%) (PctHit)
Cache hits as percentage of the total number of requests Misses (TotMiss) Intercepted HTTP requests requiring fetches from origin server. Hits (TotHit) Responses served from the integrated cache. These responses match a policy with a CACHE action. Requests (CacReq) Total cache hits plus total cache misses. Cached objects (NumCac) Responses currently in integrated cache. Includes responses fully downloaded, in the process of being downloaded, and expired or flushed but not yet removed. Hits being served (CacHit) This number should be close to the number of hits being served currently. Misses being handled (CurMiss) Responses fetched from the origin and served from the cache. Should approximate storable misses. Does not include non-storable misses. Non-304 hits (Non304Hit) Total number of full (non-304) responses served from the cache. A 304 status code indicates that a response has not been modified since the last time it was served 304 hits (304Hit) Object not modified responses served from the cache. (Status code 304 served instead of the full response.) Expire at last byte (ExpLa) Instances of content expiring immediately after receiving the last body byte due to the Expire at Last Byte setting for the content group. Flashcache misses (FlMi) Number of requests to a content group with flash cache enabled that were cache misses. Flash cache distributes the response to all the clients in aqueue. Flashcache hits (FlHi) Number of requests to a content group with flash cache enabled that were cache hits. The flash cache setting queues requests that arrive simultaneously and distributes the response to all the clients in the queue. Parameterized inval requests (PInReq) Requests matching a policy with an invalidation (INVAL) action and a content group that uses an invalidation selector or parameters. Full inval requests (NPInReq) Requests that match an invalidation policy where the invalGroups parameter is configured and expires one or more content groups. Inval requests (INStrMis) Requests that match an invalidation policy and result in expiration of specific cached responses or entire content groups. Parameterized requests (PReq) Total number of requests where the content group has hit and invalidation parameters or selectors. Parameterized non-304 hits (PN304Hit) Parameterized requests resulting in a full response (not status code 304: Object Not Updated) served from the cache.
Parameterized 304 hits (P304Hit) Parameterized requests resulting in an object not modified (status code 304) response. Poll every time requests (PeReq) Requests that triggered a search of a content group that has Poll Every Time (PET) enabled (always consult the origin server before serving cached data). Memory allocation failures (ErrMem) Total number of times the cache failed to allocate memory to store responses. Largest response so far(B) (LarResp) Size, in bytes, of largest response sent to client from the cache or the origin server. Compressed bytes transmitted Number of bytes the NetScaler sends to the client after compressing the response from the server. Compressible bytes received Number of bytes that can be compressed, which the NetScaler receives from the server. This gives the content length of the response that the NetScaler receives from server. Response bytes received (HTRspbRx) Total number of bytes of HTTP response data received. Example
Related Commands stat cache policy stat cache policylabel
add cache policy

Synopsis add cache policy <policyName> -rule <expression> -action <action> [-storeInGroup <string>] [-invalGroups <string> ...] [-invalObjects <string> ...] [-undefAction ( NOCACHE | RESET )] Description Create Integrated Cache policies. The newly created policy is in the inactive state. To activate the policy, use the ###bind cache global### command. The type of the policy depends on whether it is a request policy or a response policy, and the type of the specified action, as follows: CACHE or MAY_CACHE action: positive cachability policy NOCACHE or MAY_NOCACHE action: negative cachability policy INVAL action: Dynamic Invalidation Policy The order in which the policies are configured is significant. For a detailed discussion of the significance of the order, see the System Installation and Configuration Guide. Arguments policyName The name of the new Integrated Cache policy. rule The request/response rule that will trigger the given action. The only actions you can specify with a request rule are: MAY_CACHE, MAY_NOCACHE, and INVAL. You specify a rule using a single expression or a logical combination of expressions (called a compound expression). You can combine xpressions using the && and || operators. For more information on creating expressions, refer to the add expression CLI command. Note: If a compound expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are examples of valid expressions: ns_ext_cgi||ns_ext_asp "ns_non_get && (ns_header_cookie||ns_header_pragma)"
action The integrated cache action to be applied when the system finds content that matches the rules. Possible values: CACHE, NOCACHE, MAY_CACHE, MAY_NOCACHE, INVAL storeInGroup The content group where the object will be stored when the action directive is CACHE invalGroups The content group(s) to be invalidated when the action directive is INVAL invalObjects The content group(s) where the objects will be invalidated when the action directive is INVAL undefAction A CACHE action, which is used by the policy when the rule evaluation is undefined. The undef action can be NOCACHE or RESET. Possible values: NOCACHE, RESET Example
Related Commands rm cache policy set cache policy unset cache policy show cache policy stat cache policy rename cache policy
rm cache policy
Synopsis rm cache policy <policyName> Description Remove the specified Integrated Cache policy. Arguments policyName The name of the cache policy to be removed. Example
Related Commands add cache policy set cache policy unset cache policy show cache policy stat cache policy
rename cache policy
set cache policy

Synopsis set cache policy <policyName> [-rule <expression>] [-action <action>] [-storeInGroup <string>] [-invalGroups <string> ...] [-invalObjects <string> ...] [-undefAction ( NOCACHE | RESET )] Description Set a new rule/action/storeInGroup/invalGroups/invalObjects/undefAction for existing cache policy. The rule flow type can change only if action and undefAction(if present) are of NEUTRAL flow type Arguments policyName The name of the new Integrated Cache policy. rule The request/response rule that will trigger the given action. The only actions you can specify with a request rule are: MAY_CACHE, MAY_NOCACHE, and INVAL. You specify a rule using a single expression or a logical combination of expressions (called a compound expression). You can combine xpressions using the && and || operators. For more information on creating expressions, refer to the add expression CLI command. Note: If a compound expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are examples of valid expressions: ns_ext_cgi||ns_ext_asp "ns_non_get && (ns_header_cookie||ns_header_pragma)" action The integrated cache action to be applied when the system finds content that matches the rules. Possible values: CACHE, NOCACHE, MAY_CACHE, MAY_NOCACHE, INVAL storeInGroup The content group where the object will be stored when the action directive is CACHE invalGroups The content group(s) to be invalidated when the action directive is INVAL invalObjects The content group(s) where the objects will be invalidated when the action directive is INVAL undefAction A CACHE action, to be used by the policy when the rule evaluation turns out to be undefined. The undef action can be NOREWRITE or RESET. Possible values: NOCACHE, RESET Example set cache policy pol9 -rule "http.req.HEADER(\\"header\\").CONTAINS(\\"qh2\\")" Related Commands add cache policy rm cache policy unset cache policy show cache policy stat cache policy rename cache policy
unset cache policy

Synopsis unset cache policy <policyName> [-storeInGroup] [-invalGroups] [-invalObjects] [-undefAction] Description Use this command to remove cache policy settings.Refer to the set cache policy command for meanings of the arguments. Arguments Example
Related Commands add cache policy rm cache policy set cache policy show cache policy stat cache policy rename cache policy
show cache policy

Synopsis show cache policy [<policyName>] show cache policy stats - alias for 'stat cache policy' Description Display all configured cache policies. To display a single cache policy, specify the name of the policy. When all Integrated Cache policies are displayed, the order of the displayed policies within each group is the same as the evaluation order of the policies. There are three groups: request policies, response policies, and dynamic invalidation policies. Arguments policyName The name of the cache policy to be displayed. summary fullValues format level stateflag rule The request/response rule that will trigger the specified action. action The integrated cache action to be applied when the system sees content that matches the rules. storeInGroup
The content group that will store the object when the action directive is CACHE. invalGroups The content group(s) to be invalidated when the action directive is INVAL. invalObjects The content group(s) whose objects will be invalidated when the action directive is INVAL. priority Priority. hits Hits. undefAction A CACHE action, to be used by the policy when the rule evaluation turns out to be undefined. undefHits Number of Undef hits. flags Flag. precedeDefRules Override default request/response cacheability rules. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. bindPolicyType vserverType count Example
Related Commands add cache policy rm cache policy set cache policy unset cache policy stat cache policy rename cache policy
stat cache policy

Synopsis stat cache policy [<policyName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display cache policy statistics. Arguments policyName The name of the cache policy for which statistics will be displayed. If not given statistics are shown for all cache policies. count devno stateflag Policy hits (Hits) Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example stat cache policy Related Commands add cache policy rm cache policy set cache policy unset cache policy show cache policy rename cache policy stat cache stat cache policylabel
rename cache policy

Synopsis rename cache policy <policyName>@ <newName>@ Description Rename a cache policy. Arguments policyName The name of the cache policy. newName The new name of the cache policy.
Example rename cache policy oldname newname Related Commands add cache policy rm cache policy set cache policy unset cache policy show cache policy stat cache policy
add cache policylabel

Synopsis add cache policylabel <labelName> -evaluates <evaluates> Description Add a cache policy label. Arguments labelName Name of the cache policy label. evaluates Gives when policies bound to this label get executed. Possible values: REQ, RES, MSSQL_REQ, MSSQL_RES, MYSQL_REQ, MYSQL_RES Example add cache policylabel cache_http_url -evaluates REQ Related Commands rm cache policylabel bind cache policylabel unbind cache policylabel show cache policylabel stat cache policylabel rename cache policylabel
rm cache policylabel
Synopsis rm cache policylabel <labelName> Description Remove a cache policy label. Arguments labelName Name of the cache policy label.
Example rm cache policylabel cache_http_url Related Commands add cache policylabel bind cache policylabel unbind cache policylabel show cache policylabel stat cache policylabel rename cache policylabel
bind cache policylabel

Synopsis bind cache policylabel <labelName> -policyName <string> -priority <positive_integer> [-gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] Description Bind the cache policy to one of the labels. Arguments labelName Name of the cache policy label. policyName The cache policy name. Example i) bind cache policylabel cache_http_url pol_1 1 2 -invoke reqvserver CURRENT ii) bind cache policylabel cache_http_url pol_2 2 Related Commands add cache policylabel rm cache policylabel unbind cache policylabel show cache policylabel stat cache policylabel rename cache policylabel
unbind cache policylabel

Synopsis unbind cache policylabel <labelName> -policyName <string> [-priority <positive_integer>] Description Unbind entities from cache label. Arguments labelName
Name of the cache policy label. policyName The cache policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind cache policylabel cache_http_url pol_1 Related Commands add cache policylabel rm cache policylabel bind cache policylabel show cache policylabel stat cache policylabel rename cache policylabel
show cache policylabel

Synopsis show cache policylabel [<labelName>] Description Display policy label or policies bound to cache policylabel. Arguments labelName Name of the cache policy label. summary fullValues format level stateflag flags evaluates Gives when policies bound to this label get executed. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The cache policy name. priority Specifies the priority of the policy.
gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound cache policy. count Example i) show cache policylabel cache_http_url ii) show cache policylabel Related Commands add cache policylabel rm cache policylabel bind cache policylabel unbind cache policylabel stat cache policylabel rename cache policylabel
stat cache policylabel

Synopsis stat cache policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of cache policylabel(s). Arguments labelName The name of the cache policy label for which statistics will be displayed. If not given statistics are shown for all cache policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add cache policylabel
rm cache policylabel bind cache policylabel unbind cache policylabel show cache policylabel rename cache policylabel stat cache stat cache policy
rename cache policylabel

Synopsis rename cache policylabel <labelName>@ <newName>@ Description Rename a cache policy label. Arguments labelName The name of the cache policylabel. newName The new name of the cache policylabel. Example rename cache policylabel oldname newname Related Commands add cache policylabel rm cache policylabel bind cache policylabel unbind cache policylabel show cache policylabel stat cache policylabel
add cache contentGroup

Synopsis add cache contentGroup <name> [-weakPosRelExpiry <secs> | -relExpiry <secs> | -relExpiryMilliSec <msecs> | -absExpiry <HH:MM> ... | -absExpiryGMT <HH:MM> ...] [-heurExpiryParam <positive_integer>] [weakNegRelExpiry <secs>] [(-hitParams <string> ... [-ignoreParamValueCase ( YES | NO ) | -hitSelector <string> | -invalSelector <string>] [-matchCookies ( YES | NO )])] [-invalParams <string> ... [-invalRestrictedToHost ( YES | NO )]] [-pollEveryTime ( YES | NO )] [-ignoreReloadReq ( YES | NO )] [-removeCookies ( YES | NO )] [-prefetch ( YES | NO ) [-prefetchPeriod <secs> | -prefetchPeriodMilliSec <msecs>]] [-prefetchMaxPending <positive_integer>] [-flashCache ( YES | NO )] [-expireAtLastByte ( YES | NO )] [-insertVia ( YES | NO )] [-insertAge ( YES | NO )] [-insertETag ( YES | NO )] [-cacheControl <string>] [-quickAbortSize <KBytes>] [-minResSize <KBytes>] [maxResSize <KBytes>] [-memLimit <MBytes>] [-ignoreReqCachingHdrs ( YES | NO )] [-minHits <integer>] [alwaysEvalPolicies ( YES | NO )] [-pinned ( YES | NO )] [-lazyDnsResolve ( YES | NO )] [-type <type>]
Description Create a new content group. Arguments name The name of the content group to be created weakPosRelExpiry Use this parameter for responses with response codes between 200 and 399. (Similar to -relExpiry but has lesser precedence.) Default value: VAL_NOT_SET Maximum value: 31536000 heurExpiryParam The heuristic expiry time, in percent of the duration since the object was last modified Default value: VAL_NOT_SET Maximum value: 100 relExpiry The relative expiry time in seconds Default value: VAL_NOT_SET Maximum value: 31536000 relExpiryMilliSec The relative expiry time in milliseconds. Default value: VAL_NOT_SET Maximum value: 86400000 absExpiry Up to 4 times a day (local time) when all objects in the content group must expire. absExpiryGMT Up to 4 times a day (GMT), when all objects in the content group must expire. weakNegRelExpiry Use this parameter for all negative responses. This value will be used only if the expiry time cannot be determiend from any other source. Default value: VAL_NOT_SET Maximum value: 31536000 hitParams Use these parameters for parameterized hit evaluation of an object. Up to 128 parameters can be configured. invalParams Use these parameters for parameterized invalidation of an object. Up to 8 parameters can be configured. ignoreParamValueCase Use this parameter to specify whether to ignore case when comparing parameter values during parameterized hit evaluation. (Parameter value case is always ignored during parameterized invalidation.) Possible values: YES, NO Default value: VAL_NOT_SET matchCookies Use this parameter to specify whether to look for parameters also in the cookie header. Possible values: YES, NO Default value: VAL_NOT_SET invalRestrictedToHost Use this parameter to specify whether the host header should be taken into account during parameterized invalidation. Possible values: YES, NO Default value: VAL_NOT_SET pollEveryTime Use this parameter to specify whether to poll every time for the objects in this content group Possible values: YES, NO Default value: NO ignoreReloadReq Use this parameter to specify whether a request can force the system to reload a cached object from the origin. To guard against Denial of Service attacks, you should set this flag to YES. To get RFCcompliant behavior you should set it to NO. Possible values: YES, NO Default value: YES
removeCookies Use this parameter to specify whether to remove cookies from a response. Possible values: YES, NO Default value: YES prefetch Use this parameter to specify whether Integrated Cache should attempt to refresh an object immediately before it is about to go stale. Possible values: YES, NO Default value: YES prefetchPeriod The duration in seconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. Default value: VAL_NOT_SET prefetchPeriodMilliSec The duration in milliseconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. Default value: VAL_NOT_SET prefetchMaxPending The maximum number of outstanding prefetches on the contentgroup Default value: VAL_NOT_SET flashCache Use this parameter to specify whether Integrated Cache should do flash cache. Possible values: YES, NO Default value: NO expireAtLastByte Use this parameter to specify whether Integrated Cache should expire the content immediately after receving the last body byte. Possible values: YES, NO Default value: NO insertVia Use this parameter to specify whether Integrated Cache should insert a Via header. Possible values: YES, NO Default value: YES insertAge Use this parameter to specify whether Integrated Cache should insert an Age header. Possible values: YES, NO Default value: YES insertETag Use this parameter to specify whether Integrated Cache should insert an ETag header. Possible values: YES, NO Default value: YES cacheControl Use this parameter to specify the Cache-Control header to be inserted. quickAbortSize If the client aborts when the downloaded response size is less than or equal to quick-abort-size, then Integrated Cache will stop downloading the response. Default value: VAL_NOT_SET Maximum value: 4194303 minResSize The minimum size of the response. Maximum value: 2097151 maxResSize The maximum size of the response Default value: 80 Maximum value: 2097151 memLimit The memory limit for the content group, in MB. The limit is not exact. At times, a group's memory utilization may overshoot the limit, only to stabilize later. Default value: 65536 ignoreReqCachingHdrs Use this parameter to specify whether to ignore the Cache-control and Pragma headers in the incoming request. Possible values: YES, NO Default value: YES
minHits Specify the minimum number of accesses for an object to be stored in Cache. alwaysEvalPolicies Forces policy evaluation for each response arriving from origin. Possible values: YES, NO Default value: NO pinned Setting pinned to YES prevents IC from flushing objects from this contentgroup under memory pressure. Possible values: YES, NO Default value: NO lazyDnsResolve Setting this parameter to NO causes DNS resolution for every response. Setting this parameter to YES causes DNS resolution only when the destination IP in the request does not match the destination IP of the stored object. Possible values: YES, NO Default value: YES hitSelector The selector used for hit selection. invalSelector The selector used for invalidation. type This parameter will specify the type of content group Possible values: HTTP, MYSQL, MSSQL Default value: NSSVC_HTTP Example Related Commands rm cache contentGroup set cache contentGroup unset cache contentGroup show cache contentGroup expire cache contentGroup flush cache contentGroup
rm cache contentGroup
Synopsis rm cache contentGroup <name> Description Remove the specified content group. Arguments name The name of the content group to be removed. Example Related Commands add cache contentGroup set cache contentGroup
unset cache contentGroup show cache contentGroup expire cache contentGroup flush cache contentGroup
set cache contentGroup

Synopsis set cache contentGroup <name> [-weakPosRelExpiry <secs> | -relExpiry <secs> | -relExpiryMilliSec <msecs> | -absExpiry <HH:MM> ... | -absExpiryGMT <HH:MM> ...] [-heurExpiryParam <positive_integer>] [weakNegRelExpiry <secs>] [-hitParams <string> ... | -hitSelector <string> | -invalSelector <string>] [-invalParams <string> ...] [-ignoreParamValueCase ( YES | NO )] [-matchCookies ( YES | NO )] [-invalRestrictedToHost ( YES | NO )] [-pollEveryTime ( YES | NO )] [-ignoreReloadReq ( YES | NO )] [-removeCookies ( YES | NO )] [-prefetch ( YES | NO )] [-prefetchPeriod <secs> | -prefetchPeriodMilliSec <msecs>] [-prefetchMaxPending <positive_integer>] [-flashCache ( YES | NO )] [-expireAtLastByte ( YES | NO )] [-insertVia ( YES | NO )] [-insertAge ( YES | NO )] [-insertETag ( YES | NO )] [-cacheControl <string>] [-quickAbortSize <KBytes>] [-minResSize <KBytes>] [maxResSize <KBytes>] [-memLimit <MBytes>] [-ignoreReqCachingHdrs ( YES | NO )] [-minHits <integer>] [alwaysEvalPolicies ( YES | NO )] [-pinned ( YES | NO )] [-lazyDnsResolve ( YES | NO )] Description Modify attributes of the content group. Arguments name The name of the content group whose attibutes will be changed. weakPosRelExpiry Responses with response codes between 200 and 399. (Similar to -relExpiry, but has lesser precedence.) Maximum value: 31536000 heurExpiryParam The heuristic expiry time, in percentage of the elapsed time since the object was last modified. Maximum value: 100 relExpiry The relative expiry time in seconds. Default value: VAL_NOT_SET Maximum value: 31536000 relExpiryMilliSec The relative expiry time in milliseconds. Default value: VAL_NOT_SET Maximum value: 86400000 absExpiry Expiry time for all objects in the content group(up to 4 times a day [local time]). absExpiryGMT Expiry time for all objects in the content group(up to 4 times a day [GMT]). weakNegRelExpiry All negative responses. This value is used only if the expiry time cannot be determined from any other source. Maximum value: 31536000 hitParams Parameterized hit evaluation of an object. Up to 128 parameters can be configured. invalParams Parameterized invalidation of an object. Up to 8 parameters can be configured. ignoreParamValueCase
The option to ignore case while comparing parameter values during parameterized hit evaluation. The case of the parameter value is always ignored during parameterized invalidation. Possible values: YES, NO matchCookies The option to look for parameters in the cookie header. Possible values: YES, NO invalRestrictedToHost The option to consider the Host header during parameterized invalidation. Possible values: YES, NO pollEveryTime The option to poll every time for the objects in this content group. Possible values: YES, NO Default value: NO ignoreReloadReq For a request, the option to force the system to reload a cached object from the origin. To guard against Denial of Service attacks, you should set this flag to YES. To get RFC-compliant behavior, you should set it to NO. Possible values: YES, NO Default value: YES removeCookies The option to remove cookies from response. Possible values: YES, NO Default value: YES prefetch The option to refresh an object immediately before it goes stale. Possible values: YES, NO Default value: YES prefetchPeriod The duration in seconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. prefetchPeriodMilliSec The duration in milliseconds of the period during which prefetch should be attempted, immediately before the calculated expiry time. prefetchMaxPending The maximum number of outstanding prefetches on the contentgroup. flashCache The option to do flash cache on Integrated caching. Possible values: YES, NO Default value: NO expireAtLastByte The option to expire the content immediately after receving the last body byte. Possible values: YES, NO Default value: NO insertVia The option to insert a Via header. Possible values: YES, NO Default value: YES insertAge The option to insert an Age header. Possible values: YES, NO Default value: YES insertETag The option to insert an ETag header. Possible values: YES, NO Default value: YES cacheControl The option to insert a Cache-Control header. quickAbortSize The quick abort size. If the client aborts when the downloaded response size is less than or equal to the quick-abort-size, then the Integrated Cache will stop downloading the response. Maximum value: 4194303
minResSize The minimum size of the response. Maximum value: 2097151 maxResSize The maximum size of the response. Default value: 80 Maximum value: 2097151 memLimit The memory limit in MB for the content group. The limit is not exact - a group's memory utilization may overshoot the limit, only to stabilize later. Default value: 65536 ignoreReqCachingHdrs The option to ignore the Cache-control and Pragma headers in the incoming request. Possible values: YES, NO Default value: YES minHits The minimum number of accesses for an object to be stored in Cache. alwaysEvalPolicies The option to force policy evaluation for each response arriving from the origin. Possible values: YES, NO Default value: NO pinned The option for IC from flushing objects from this contentgroup under memory pressure. Set YES for IC to take this state. Possible values: YES, NO Default value: NO lazyDnsResolve Setting this parameter to NO causes DNS resolution for every response. Setting this parameter to YES causes DNS resolution only when the destination IP in the request does not match the destination IP of the stored object. Possible values: YES, NO Default value: YES hitSelector The selector used for hit selection. invalSelector The selector used for invalidation. Example
Related Commands add cache contentGroup rm cache contentGroup unset cache contentGroup show cache contentGroup expire cache contentGroup flush cache contentGroup
unset cache contentGroup

Synopsis unset cache contentGroup <name> [-weakPosRelExpiry] [-heurExpiryParam] [-relExpiry] [-relExpiryMilliSec] [-absExpiry] [-absExpiryGMT] [-weakNegRelExpiry] [-hitParams] [-invalParams] [-ignoreParamValueCase] [matchCookies] [-invalRestrictedToHost] [-pollEveryTime] [-ignoreReloadReq] [-removeCookies] [-prefetch] [prefetchPeriod] [-prefetchPeriodMilliSec] [-prefetchMaxPending] [-flashCache] [-expireAtLastByte] [-insertVia]
[-insertAge] [-insertETag] [-cacheControl] [-quickAbortSize] [-minResSize] [-maxResSize] [-memLimit] [ignoreReqCachingHdrs] [-minHits] [-alwaysEvalPolicies] [-pinned] [-lazyDnsResolve] [-hitSelector] [-invalSelector] Description Use this command to remove cache contentGroup settings.Refer to the set cache contentGroup command for meanings of the arguments. Arguments Example Related Commands add cache contentGroup rm cache contentGroup set cache contentGroup show cache contentGroup expire cache contentGroup flush cache contentGroup
show cache contentGroup

Synopsis show cache contentGroup [<name>] Description Display all content groups. To display a single content group, specify the name of the content group. Arguments name The name of the content group. summary fullValues format level flags Flags. type This parameter will specify the type of content group relExpiry The relative expiry time in seconds. relExpiryMilliSec The relative expiry time in milliseconds. absExpiry Up to 4 times a day (local time) when all objects in the content group must expire. absExpiryGMT Up to 4 times a day (GMT), when all objects in the content group must expire. heurExpiryParam
The heuristic expiry time, in percent of the duration since the object was last modified weakPosRelExpiry Use this parameter for responses with response codes between 200 and 399. (Similar to -relExpiry but has lesser precedence.) weakNegRelExpiry Use this parameter for all negative responses. This value will be used only if the expiry time cannot be determiend from any other source. hitParams Use these parameters for parameterized hit evaluation of an object. Up to 128 parameters can be configured. invalParams Use these parameters for parameterized invalidation of an object. Up to 8 parameters can be configured. ignoreParamValueCase Use this parameter to specify whether to ignore case when comparing parameter values during parameterized hit evaluation. (Parameter value case is always ignored during parameterized invalidation.) matchCookies Use this parameter to specify whether to look for parameters also in the cookie header. invalRestrictedToHost Use this parameter to specify whether the host header should be taken into account during parameterized invalidation. pollEveryTime Use this parameter to specify whether to poll every time for the objects in this content group ignoreReloadReq Use this parameter to specify whether a request can force the system to reload a cached object from the origin. To guard against Denial of Service attacks, you should set this flag to YES. To get RFCcompliant behavior you should set it to NO. removeCookies Use this parameter to specify whether to remove cookies from a response. prefetch Use this parameter to specify whether Integrated Cache should attempt to refresh an object immediately before it is about to go stale. prefetchPeriod The duration in seconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. prefetchPeriodMilliSec The duration in milliseconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. prefetchCur Current outstanding prefetches. prefetchMaxPending The maximum number of outstanding prefetches on the contentgroup flashCache Use this parameter to specify whether Integrated Cache should do flash cache.
expireAtLastByte Use this parameter to specify whether Integrated Cache should expire the content immediately after receving the last body byte. insertVia Use this parameter to specify whether Integrated Cache should insert a Via header. insertAge Use this parameter to specify whether Integrated Cache should insert an Age header. insertETag Use this parameter to specify whether Integrated Cache should insert an ETag header. cacheControl Use this parameter to specify the Cache-Control header to be inserted. quickAbortSize If the client aborts when the downloaded response size is less than or equal to quick-abort-size, then Integrated Cache will stop downloading the response. minResSize The minimum size of the response. maxResSize The maximum size of the response memUsage Current memory usage. memLimit The memory limit for the content group, in MB. The limit is not exact. At times, a group's memory utilization may overshoot the limit, only to stabilize later. ignoreReqCachingHdrs Use this parameter to specify whether to ignore the Cache-control and Pragma headers in the incoming request. cacheNon304Hits Cache non 304 hits. cache304Hits Cache 304 hits. cacheCells Number of cells. cacheGroupIncarnation Cache group incarnation. minHits Specify the minimum number of accesses for an object to be stored in Cache. alwaysEvalPolicies Forces policy evaluation for each response arriving from origin. pinned Setting pinned to YES prevents IC from flushing objects from this contentgroup under memory pressure. lazyDnsResolve
Setting this parameter to NO causes DNS resolution for every response. Setting this parameter to YES causes DNS resolution only when the destination IP in the request does not match the destination IP of the stored object. hitSelector The selector used for hit selection. invalSelector The selector used for invalidation. policyName Active cache policies refering to this group. cacheNumInvalPolicy Number of active Invalidation policies refering to this group. markerCells Numbers of marker cells in this group. count stateflag Example
Related Commands add cache contentGroup rm cache contentGroup set cache contentGroup unset cache contentGroup expire cache contentGroup flush cache contentGroup
expire cache contentGroup

Synopsis expire cache contentGroup <name> Description Expire the objects in the specified content group. Arguments name The name of the content group whose objects are to be expired. Example
Related Commands add cache contentGroup rm cache contentGroup set cache contentGroup
unset cache contentGroup show cache contentGroup flush cache contentGroup
flush cache contentGroup

Synopsis flush cache contentGroup <name> [-query <string> | -selectorValue <string>] [-host <string>] Description Flush the objects in the specified content group. Arguments name The name of the content group whose objects are to be flushed. query If a query string is specified, then the selected objects in this group will be flushed using parameterized invalidation. Otherwise, all objects in the group will be flushed. host To be set only if parameterized invalidation is being done. Objects belonging only to the specified host will be flushed. The host argument can be provided if and only if -invalRestrictedToHost is set to YES for the given group. selectorValue The value of the selector to be used for flushing objects in the contentgroup. Example Related Commands add cache contentGroup rm cache contentGroup set cache contentGroup unset cache contentGroup show cache contentGroup expire cache contentGroup
add cache forwardProxy

Synopsis add cache forwardProxy <IPAddress> <port> Description Add a forward proxy known to Integrated cache. Arguments IPAddress The IP address of the forward proxy. port The port of the forward proxy. Minimum value: 1
Example Related Commands rm cache forwardProxy show cache forwardProxy
rm cache forwardProxy
Synopsis rm cache forwardProxy <IPAddress> <port> Description Remove a forward proxy known to Integrated cache. Arguments IPAddress The IP address of the forward proxy. port The port of the forward proxy. Minimum value: 1 Example Related Commands add cache forwardProxy show cache forwardProxy
show cache forwardProxy

Synopsis show cache forwardProxy Description Display all forward proxies known to Integrated cache. Arguments summary fullValues format level IPAddress The IP address of the forward proxy. port Forward proxy port. count stateflag Example
Related Commands add cache forwardProxy rm cache forwardProxy
add cache selector

Synopsis add cache selector <selectorName> <rule> ... Description Create Integrated Cache selectors. A selector is an abstraction for a collection of PIXL expressions. After creating a selector, you can use it as either a hitSelector (for doing hit selection) or as an invalSelector (for invalidating cached objects), or both. You need to specify at least one expression when you create a selector. Arguments selectorName The name of the Integrated Cache selector. rule The set of PIXL expressions. Example Related Commands rm cache selector set cache selector show cache selector
rm cache selector
Synopsis rm cache selector <selectorName> Description Use this command to remove Integrated Cache selectors. Arguments selectorName The name of the Integrated Cache selector. Example Related Commands add cache selector set cache selector show cache selector
set cache selector

Synopsis set cache selector <selectorName> <rule> ...
Description Change the set of expressions associated with Integrated Cache selectors. Arguments selectorName The name of the Integrated Cache selector. rule The PIXL expressions. Example
Related Commands add cache selector rm cache selector show cache selector
show cache selector

Synopsis show cache selector [<selectorName>] Description Display Integrated Cache selectors. Arguments selectorName The name of the Integrated Cache selector. summary fullValues format level flags Flags. rule Rule. count stateflag Example
Related Commands add cache selector rm cache selector set cache selector
show cache object

Synopsis show cache object [(-url <URL> (-host <string> [-port <port>] [-groupName <string>] [-httpMethod ( GET | POST )])) | -locator <positive_integer> | -httpStatus <positive_integer> | -group <string> | -ignoreMarkerObjects ( ON | OFF ) | -includeNotReadyObjects ( ON | OFF )] Description Show a list of all cached objects, or the properties of a particular cache object. Arguments url The URL of the object. locator The id of the cached object. httpStatus HTTP status of the object. host The hostname of the object. port The host port of the object. Default value: 80 Minimum value: 1 groupName The name of the content group to be in which the cell is present httpMethod The HTTP request method that caused the object to be stored. Possible values: GET, POST Default value: NS_HTTP_METHOD_GET group The name of the content group whose objects should be listed. ignoreMarkerObjects Ignore marker objects Possible values: ON, OFF includeNotReadyObjects Include objects not-ready for a cache hit Possible values: ON, OFF summary fullValues cacheResSize Cache response size of the object. cacheResHdrSize Cache response header size of the object. cacheETag Cache ETag of the object. httpStatusOutput HTTP status of the object. cacheResLastMod Value of "Last-modified" header. cacheControl
Cache-Control header of the object. cacheResDate Value of "Date" header contentGroup Name of the contentgroup in which it is stored. destIP Destination IP. destIPV46 Destination IP. destPort Destination Port. cacheCellComplex The state of the parameterized caching on this cell. hitParams Parameterized hit evaluation of an object. hitValues Values of hitparams for this object. cacheCellReqTime Required time of the cache cell object. cacheCellResTime Response time to the cache cell object. cacheCurAge Current age of the cache object. cacheCellExpires Expiry time of the cache cell object in seconds. cacheCellExpiresMilliSec Expiry time of the cache cell object in milliseconds. flushed Specifies whether the object is flushed. prefetch Specifies whether Integrated Cache should attempt to refresh an object immediately before it goes stale. prefetchPeriod The duration in seconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. prefetchPeriodMilliSec The duration in milliseconds of the period during which prefetch should be attempted, immediately before the object's calculated expiry time. cacheCellCurReaders Current readers of the cache cell object. cacheCellCurMisses Current misses of the cache cell object. cacheCellHits
Cache cell hits. cacheCellMisses Cache cell misses. cacheCellGzipCompressed The state of the response being gzip-compressed. cacheCellDeflateCompressed The state of the response being deflate-compressed. cacheCellCompressionFormat Compression format of this object. Identity means not compressed cacheCellAppFWMetadataExists AppFirewall cache object. cacheCellHttp11 The state of the response to be HTTP/1.1. cacheCellWeakEtag The state of the weak HTTP Entity Tag in the cell. cacheCellResBadSize The marked state of the cell. markerReason Reason for marking the cell. cacheCellPollEveryTime The state to poll every time on object. cacheCellEtagInserted The state of the ETag to be inserted by IC for this object. cacheCellReadyWithLastByte The state of the complete arrived response. cacheCellDestipVerified The state of DNS verification. cacheCellFwpxyObj The state of the object to be stored on a request to a forward proxy. cacheCellBasefile The state of delta being used as a basefile. cacheCellMinHitFlag The state of the minhit feature on this cell. cacheCellMinHit Min hit value for the object. policy Policy info for the object. policyName Policy which created the object. selectorName The hit selector for the object. rule
Selectors for this object. selectorValue The HTTP request method that caused the object to be stored. cacheUrls List of cache object URLs. numurls Total number of cache object entries returned in cacheUrls field warnBucketSkip Bucket skipped warning. totalObjs Total objects. httpCalloutCell Is it a http callout cell ? httpCalloutName Name of the http callout returnType Return type of the http callout httpCalloutResult First few bytes of http callout response ceflags Indicates state and type of cached cell count stateflag Example
Related Commands expire cache object flush cache object
expire cache object

Synopsis expire cache object (-locator <positive_integer> | (-url <URL> (-host <string> [-port <port>] [-groupName <string>] [-httpMethod ( GET | POST )]))) Description Expire a cached object. Arguments locator The id of the cached object. url The URL of the object to be expired.
host The host of the object to be expired. port The host port of the object to be expired. Default value: 80 Minimum value: 1 groupName The name of the content group to be in which the cell is present. httpMethod The HTTP request method that caused the object to be stored. Possible values: GET, POST Default value: NS_HTTP_METHOD_GET Example
Related Commands show cache object flush cache object
flush cache object

Synopsis flush cache object (-locator <positive_integer> | (-url <URL> (-host <string> [-port <port>] [-groupName <string>] [-httpMethod ( GET | POST )]))) Description Flush a cached object. Arguments locator The ID of the cached object. url The URL of the object to be flushed. host The host of the object to be flushed. port The host port of the object to be flushed. Default value: 80 Minimum value: 1 groupName The name of the content group to be in which the cell is present. httpMethod The HTTP request method that caused the object to be stored. Possible values: GET, POST Default value: NS_HTTP_METHOD_GET Example
Related Commands show cache object expire cache object
show cache stats

Synopsis show cache stats - alias for 'stat cache' Description show cache stats is an alias for stat cache Arguments Example
Related Commands stat cache
bind cache global

Synopsis bind cache global <policy> -priority <positive_integer> [-gotoPriorityExpression <expression>] [-type <type>] [invoke (<labelType> <labelName>) ] Description Bind the cache policy to one of the two global lists of cache policies. A policy becomes active only after it is bound. All HTTP traffic will be evaluated against these two policy banks. There is a request time policy bank and a response time policy bank. The flow type of the policy implicitly determines which bank it gets bound to. Each bank of policies is an ordered list ordered by policies priority values. Policy Bank Evaluation The goal of evaluation is to traverse the ordered list of policies in the bank, find out which policies match and build a result set that will contain the actions of all the matching policies. While evaluating a policy if any PIXL expression cannot be evaluated then UNDEF processing will get triggered. There are also other scenarios during policy traversal when UNDEF processing can get triggered. If an UNDEF event occurs while processing a policy, then (i) policy bank traversal ends, (ii) the result set of actions that was built so far is wiped out (iii) the current policy's undefAction is put in the result set and the evaluation ends. Arguments policy The name of the Integrated Cache policy to be bound. Example
Related Commands unbind cache global show cache global
unbind cache global

Synopsis unbind cache global <policy> [-type <type>] [-priority <positive_integer>]
Description Inactivate the policy. Arguments policy The name of the Integrated Cache policy to unbind priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example
Related Commands bind cache global show cache global
show cache global

Synopsis show cache global [-type <type>] Description Display the cache global bindings. Arguments type The bindpoint to which policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT, RES_OVERRIDE, RES_DEFAULT summary fullValues format level policyName Name of the cache policy. policy Name of the cache policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE.
numpol The number of policies bound to the bindpoint. flowType flowtype of the bound cache policy. rule The request/response rule that will trigger the given action. action The integrated cache action to be applied when the system sees content that matches the rules. storeInGroup The content group to store the object when the action directive is CACHE. invalGroups The content group(s) to be invalidated when the action directive is INVAL. invalObjects The content group(s) whose objects will be invalidated when the action directive is INVAL. hits Hits. flags Flags. precedeDefRules Override the default request/response cacheability rules. stateflag count Example show cache global
Related Commands bind cache global unbind cache global
set cache parameter

Synopsis set cache parameter [-memLimit <MBytes>] [-via <string>] [-verifyUsing <verifyUsing>] [-maxPostLen <positive_integer>] [-prefetchMaxPending <positive_integer>] [-enableBypass ( YES | NO )] [-undefAction ( NOCACHE | RESET )] Description Modify the global configuration of the Integrated Cache. Arguments memLimit The memory limit for Integrated Cache. via
The string to be inserted in the "Via" header. A Via header is inserted in all responses served from a content group if its insertVia flag is set. verifyUsing The criteria for deciding whether a cached object can be served for an incoming HTTP request. a. If the value of this attribute is set to HOSTNAME, then URL , host name and host port values in the incoming HTTP request header must match before a cached object can be served. The IP address and the TCP port of the destination host are not matched. For certain deployments the HOSTNAME setting can be a security risk. A rogue client can access a rogue server via the Integrated Cache using the following HTTP request : GET / HTTP/1.1 Host: sensitive.foo.com Integrated Cache will store the rogue page served by the rogue server. Any subsequent client trying to access the root page from sensitive.foo.com will be served the rogue page. The HOSTNAME setting should only be set if it is certain that no rogue client can access a rogue server via the Integrated Cache. The YES setting can lead to more hits if DNS-based load balancing is in use and the same content can be served by multiple backend servers. b. If the attribute is set to HOSTNAME_AND_IP, then the following items must match: URL, host name, host port in the incoming HTTP request header, and the IP address and TCP port of the destination server. c. If the attribute is set to DNS, then the following items should match: URL, host name and host port in the incoming HTTP request, and the TCP port. The hostname is used to do a DNS lookup of the destination server's IP address, and is compared with the set of addresses returned by the DNS lookup. The default value of this attribute is DNS. Possible values: HOSTNAME, HOSTNAME_AND_IP, DNS maxPostLen maximum number of POST body bytes to consider when evaluating parameters for a content group for which you have configured hitParams and invalParams. Maximum value: 131072 prefetchMaxPending The maximum number of outstanding prefetches in the IC. enableBypass The bypass parameter. When this value is set to NO, an incoming request will serve a hit if a matching object is found in cache storage, regardless of the cacheability policy configuration. If set to YES, the bound request cacheability policies are evaluated before attempting any hit selection in the cache storage. If the request matches a policy with a NOCACHE action, the request will bypass all cache processing. This flag does not affect processing of requests that match any invalidation policy. Possible values: YES, NO undefAction Set the default cache undef action. If an UNDEF event is triggered during policy evaluation and if the current policy's undefAction is not specified, then this global undefAction value is used. Can be NOCACHE or RESET. NOCACHE is the default value of default cache undef action. Possible values: NOCACHE, RESET Example
Related Commands unset cache parameter show cache parameter
unset cache parameter

Synopsis unset cache parameter [-memLimit] [-via] [-verifyUsing] [-maxPostLen] [-prefetchMaxPending] [-enableBypass] [undefAction]
Description Use this command to remove cache parameter settings.Refer to the set cache parameter command for meanings of the arguments. Arguments Example
Related Commands set cache parameter show cache parameter
show cache parameter

Synopsis show cache parameter Description Display the global configuration of the Integrated Cache. Arguments format level memLimit The memory limit for the Integrated Cache. memLimitActive Active value of the memory limit for the Integrated Cache. maxMemLimit The maximum value of the memory limit for the Integrated Cache. via The string that is inserted in the "Via" header. verifyUsing The criteria for deciding whether a cached object can be served for an incoming HTTP request. maxPostLen The maximum POST body size that the IC can accumulate. prefetchCur Number of current outstanding prefetches in the IC. prefetchMaxPending The maximum number of outstanding prefetches on the content group. enableBypass When this value is set to NO, an incoming request will serve a hit if a matching object is found in cache storage, regardless of the cacheability policy configuration. If set to YES, the bound request cacheability policies are evaluated before attempting any hit selection in the cache storage. If the request matches a policy with a NOCACHE action, the request will bypass all cache processing. This flag does not affect processing of requests that match any invalidation policy.
undefAction Set the default cache undef action. If an UNDEF event is triggered during policy evaluation and if the current policy's undefAction is not specified, then this global undefAction value is used. Can be NOCACHE or RESET. NOCACHE is the default value of default cache undef action. Example
Related Commands set cache parameter unset cache parameter
Chapter
12
CLI Commands
Topics: config whoami exit quit man history help source batch unalias alias cls show cli attribute clear cli prompt set cli prompt show cli prompt set cli mode unset cli mode show cli mode
382 | Citrix NetScaler 10 | CLI Commands
config
Synopsis config Description Enter this command to enter contextual mode. Arguments Example
Related Commands
whoami
Synopsis whoami Description Show the current user. Arguments userName loggedIn Example
Related Commands
exit
Synopsis exit Description Use this command to back out one level in config mode, or to terminate the CLI when not in config mode. ); Arguments Example
Related Commands
quit
Synopsis quit
Citrix NetScaler 10 | CLI Commands | 383
Description Use this command to terminate the CLI. Note: typing <Ctrl>+<d> will also terminate the CLI. Arguments Example
Related Commands
man
Synopsis man [(commandName)] Description Use this command to invoke the man page for the specified command. You can specify the command in full, or partially, if it is uniquely resolvable. Arguments commandName The name of the command. Example man add vs
Related Commands
history
Synopsis history Description Use this command to see the history of the commands executed on CLI. Arguments Example history 1 add snmp trap SPECIFIC 10.102.130.228 2 save config 3 show system session 4 swhell 5 shell 6 what 7 shell 8 help stat lbvserver ...
Related Commands
help
Synopsis help [(commandName) | <groupName> | -all]
Description Use this command to display help information for a CLI command, for a group of commands, or for all CLI commands. Arguments commandName The name of a command for which you want full usage information. groupName The name of a command group for which you want basic usage information. all Use this option to request basic usage information for all commands. Example 1.To view help information for adding a virtual server, enter the following CLI command: help add vserver The following information is displayed: Usage: add vserver <vServerName> <serviceType> [<IPAddress> port>] [-type ( CONTENT | ADDRESS )] [-cacheType <cacheType>] [-backupVServerName <string>] [-redirectURL <URL>] [-cacheable ( ON | OFF )] [-state ( ENABLED | DISABLED )] where: serviceType = ( HTTP | FTP | TCP | UDP | SSL | SSL_BRIDGE | SSL_TCP | NNTP| DNS | ANY ) <cacheType> = ( TRANSPARENT | REVERSE | FORWARD ) Done 2.To view help information for all DNS commands, enter the following command: help dns The following information is displayed: add aaaaRec <hostname> <IPv6Address> ... [-TTL <secs>] rm aaaaRec <hostname> [<IPv6Address> ...] show aaaaRec [<hostname> | -type <type>] add addRec <hostname> <IPAddress> ... [-TTL <secs>] [private <ip_addr>] rm addRec <hostname> [<IPAddress> ...] show addRec [<hostname> | type <type>] add cnameRec <aliasName> <canonicalName> [-TTL <secs>] rm cnameRec <aliasName> show cnameRec [<aliasName> | -type <type>] add mxRec <domain> -mx <string> -pref <positive_integer> [-TTL <secs>] rm mxRec <domain> <mx> set mxRec <domain> -mx <string> [-pref <positive_integer>] [-TTL <secs>] show mxRec [<domain> | -type <type>] add nsRec <domain> [-p <string>] [-s <string>] [-TTL <secs>] rm nsRec <domain> [-p <string> | -s <string>] show nsRec [<domain> | -type <type>] set dns parameter [-timeout <secs>] [-retries <positive_integer>] [-minTTL <secs>] [-maxTTL <secs>] [-TTL ( ENABLED | DISABLED )] [-cacheRecords ( YES | NO )] show dns parameter add soaRec <domain> -contact <string> -serial <positive_integer> -refresh <secs> -retry <secs> -expire <secs> -minimum <secs>-TTL <secs> rm soaRec <domain> set soaRec <domain> [-contact <string>] [-serial <positive_integer>][-refresh <secs>] [-retry <secs>] [-expire <secs>] [minimum <secs>][-TTL <secs>] show soaRec [<domain> | -type <type>] add dns ptrRec <reverseDomain> <domain> ... [-TTL <secs>] rm dns ptrRec <reverseDomain> [<domain> ...] show dns ptrRec [<reverseDomain> | -type <type>] add dns srvRec <domain> <target> priority <positive_integer> -weight <positive_integer> -port <positive_integer> rm dns srvRec <domain> [<target> ...] set dns srvRec <domain> <target> [-priority <positive_integer>] [-weight <positive_integer>] [-port <positive_integer>] [-TTL <secs>] show dns srvRec [(<domain> [<target>]) | -type <type>] Done Related Commands
source
Synopsis source <fileName> Description Use this command to read the contents of a file and execute each line as a separate CLI command. Each command in the file being read must be on a separate line. Lines starting with # are considered comments.
Arguments fileName The name of the file to be sourced. Example source cmds.txt
Related Commands
batch
Synopsis batch -fileName <input_filename> [-outfile <output_filename>] [-ntimes <positive_integer>] Description Use this command to read the contents of a file and execute each line as a separate CLI command. Each command in the file must be on a separate line. Lines starting with # are considered comments. Arguments fileName The name of the batch file. outfile The name of the file where the executed batch file will write its output. The default is standard output. ntimes The number of times the batch file will be executed. Default value: 1 Example batch -f cmds.txt
Related Commands
unalias
Synopsis unalias <pattern> Description Remove an alias Arguments pattern Name of the alias Example unalias info
Related Commands
alias
Synopsis alias [<pattern> [(command)]] Description Create (short) aliases for (long) commands. Aliases are saved across NSCLI sessions. If no argument is specified, the alias command will display existing aliases. Arguments pattern Alias name. (Can be a regular expression.) Example alias info "show ns info"
Related Commands
cls
Synopsis cls Description Clear the screen and reposition cursor at top right. Arguments Example
Related Commands
show cli attribute

Synopsis show cli attribute Description Display attributes of the NetScaler CLI Arguments qquote The construct that is used to quote strings that are to be taken as-is, without interpreting escape sequences like " ". This construct consists of: a 'q', followed by a delimiter character; the string
follows immediately after the delimiter and is terminated by the first matching delimiter character. (The set of possible delimiter characters is listed below.) For example, q/a / will result in a threecharacter string ('a', '', 'n'); whereas "a " results in a two-character string ('a' followed by a newline). qquoteDelimiters The set of characters that can be used as the delimiter in a q// construct. Characters shown in pairs must be used that way, whereas characters shown singly server as thier own matching delimiter. For example, q?abc? and q{abc} are valid q// constructs, and evaluate to the string "abc"; q{abc{ is however not a valid q// construct so it will evaluate to the string "q{abc{". Example
Related Commands
clear cli prompt

Synopsis clear cli prompt Description Use this command to return the CLI prompt to the default (a single '>'). Arguments Example
Related Commands set cli prompt show cli prompt
set cli prompt

Synopsis set cli prompt <promptString> Description Use this command to customize the CLI prompt. Arguments promptString The prompt string. The following special values are allowed: %! - will be replaced by the history event number %u - will be replaced by the NetScaler user name %h - will be replaced by the NetScaler hostname %t - will be replaced by the current time %T - will be replaced by the current time (24 hr format) %d - will be replaced by the current date %s - will be replaced by the node state Example > set cli prompt "%h %T" Done lb-ns1 15:16>
Related Commands clear cli prompt show cli prompt
show cli prompt

Synopsis show cli prompt Description Use this command to display the current CLI prompt, with special values like '%h' unexpanded. Arguments format level promptString Example 10.101.4.22 15:20> sh cli prompt CLI prompt is set to "%h %T" Done
Related Commands clear cli prompt set cli prompt
set cli mode

Synopsis set cli mode [-page ( ON | OFF )] [-total ( ON | OFF )] [-color ( ON | OFF )] [-disabledFeatureAction <disabledFeatureAction>] [-timeout <secs>] [-regex ( ON | OFF )] Description Use this command to specify how the CLI should display command output. Arguments page Determines whether output that spans more than one screen is "paged". Specify ON to pause the display after each screen of ouput. Possible values: ON, OFF Default value: OFF total Determines whether CLI "show" commands display a total count of objects before displaying the objects themselves. Possible values: ON, OFF Default value: OFF color Specifies whether output can be shown in color, if the terminal supports it. Possible values: ON, OFF Default value: OFF disabledFeatureAction
Specifies what will happen when a configuration command is issued for a disabled feature. The following values are allowed: NONE - The action is allowed, and no warning message is issued.; ALLOW - The action is allowed, but a warning message is issued.; DENY - The action is not allowed.; HIDE - Commands that configure disabled features are hidden, and the CLI behaves as if they did not exist. Possible values: NONE, ALLOW, DENY, HIDE Default value: NS_ALLOW timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Default value: 300 Maximum value: 100000000 regex If ON, regular expressions can be used as argument values Possible values: ON, OFF Default value: ON Example
Related Commands unset cli mode show cli mode
unset cli mode

Synopsis unset cli mode [-page] [-total] [-color] [-disabledFeatureAction] [-timeout] [-regex] Description Use this command to remove cli mode settings.Refer to the set cli mode command for meanings of the arguments. Arguments Example
Related Commands set cli mode show cli mode
show cli mode

Synopsis show cli mode Description Use this command to display the current settings of parameters that can be set with the 'set cli mode' command. Arguments format level
page Determines whether output that spans more than one screen is "paged". Specify ON to pause the display after each screen of ouput. total Determines whether CLI "show" commands display a total count of objects before displaying the objects themselves. color Specifies whether output can be shown in color, if the terminal supports it. disabledFeatureAction Specifies what will happen when a configuration command is issued for a disabled feature. The following values are allowed: NONE - The action is allowed, and no warning message is issued.; ALLOW - The action is allowed, but a warning message is issued.; DENY - The action is not allowed.; HIDE - Commands that configure disabled features are hidden, and the CLI behaves as if they did not exist. argMark mark noLicenseAction no licence diagLevel diagnostic level timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. regex If ON, regular expressions can be used as argument values r regular expression format format stats serverPort Example
Related Commands set cli mode unset cli mode
Chapter
13
Cluster Commands
Topics: join cluster add cluster instance rm cluster instance set cluster instance unset cluster instance enable cluster instance disable cluster instance show cluster instance add cluster node set cluster node unset cluster node rm cluster node show cluster node sync cluster files
392 | Citrix NetScaler 10 | Cluster Commands
join cluster
Synopsis join cluster -clip <ip_addr|*> {-password } Description join cluster -clip <ipaddress> Arguments clip The cluster IP. password Enter the password of cluster IP. Example
Related Commands
add cluster instance

Synopsis add cluster instance <clId> [-deadInterval <secs>] [-helloInterval <msecs>] [-preemption ( ENABLED | DISABLED )] Description Add a new cluster to the system Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 deadInterval Dead Interval in Seconds. This interval is the minimum time during which if no heartbeats are received from a peer cluster node, it is assumed that a peer cluster node is down Default value: 3 Minimum value: 3 Maximum value: 60 helloInterval Hello Interval in MilliSeconds. This interval is the duration after which after which HA Heartbeats are sent to peer cluster nodes. Default value: 200 Minimum value: 200 Maximum value: 1000 preemption Enable/Disable the preemption of the Cluster spare nodes Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands rm cluster instance
Citrix NetScaler 10 | Cluster Commands | 393
set cluster instance unset cluster instance enable cluster instance disable cluster instance show cluster instance
rm cluster instance
Synopsis rm cluster instance <clId> Description Set the parameters of a cluster Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 Example
Related Commands add cluster instance set cluster instance unset cluster instance enable cluster instance disable cluster instance show cluster instance
set cluster instance

Synopsis set cluster instance <clId> [-deadInterval <secs>] [-helloInterval <msecs>] [-preemption ( ENABLED | DISABLED )] Description Set the parameters of a cluster Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 deadInterval Dead Interval in Seconds. This interval is the minimum time during which if no heartbeats are received from a peer cluster node, it is assumed that a peer cluster node is down Default value: 3 Minimum value: 3 Maximum value: 60
helloInterval Hello Interval in MilliSeconds. This interval is the duration after which after which HA Heartbeats are sent to peer cluster nodes. Default value: 200 Minimum value: 200 Maximum value: 1000 preemption Enable/Disable the preemption of the Cluster spare nodes Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands add cluster instance rm cluster instance unset cluster instance enable cluster instance disable cluster instance show cluster instance
unset cluster instance

Synopsis unset cluster instance <clId> [-deadInterval] [-helloInterval] [-preemption] Description Use this command to remove cluster instance settings.Refer to the set cluster instance command for meanings of the arguments. Arguments Example
Related Commands add cluster instance rm cluster instance set cluster instance enable cluster instance disable cluster instance show cluster instance
enable cluster instance

Synopsis enable cluster instance <clId>
Description Enable a cluster Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 Example
Related Commands add cluster instance rm cluster instance set cluster instance unset cluster instance disable cluster instance show cluster instance
disable cluster instance

Synopsis disable cluster instance <clId> Description Disable a cluster Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 Example
Related Commands add cluster instance rm cluster instance set cluster instance unset cluster instance enable cluster instance show cluster instance
show cluster instance

Synopsis show cluster instance [<clId>]
Description Display information about all the nodes in the specified cluster. Arguments clId The unique number that identifies a cluster. Minimum value: 1 Maximum value: 16 summary fullValues format level deadInterval Dead Interval in Seconds. This interval is the minimum time during which if no heartbeats are received from a peer cluster node, it is assumed that a peer cluster node is down helloInterval Hello Interval in MilliSeconds. This interval is the duration after which after which HA Heartbeats are sent to peer cluster nodes. preemption Enable/Disable the preemption of the Cluster spare nodes adminstate Cluster Admin State. propState Enable/Disable the execution of commands on the cluster. This will not impact the execution of commands on individual cluster nodes by using the NSIP. nodeId The unique number that identiies a cluster. IPAddress The IP Address of the node. flags The flags for this entry. masterState Master state. health Node Health state. clusterHealth Node clusterd state. effectiveState Node effective health state. flag Cluster Flag. operationalstate Cluster Operational State. status Cluster Operational State.
isCCO This argument is used to determine whether the node is CCO. isLocalnode This argument is used to determine whether it is local node. stateflag State Flag. operationalPropState Cluster Operational Propagation State. count Example An example of the command's output is as follows: 1)Cluster ID: 1 Dead Interval: 3 secs Hello Interval: 200 msecs Preemption: DISABLED Cluster Status: DISABLED(admin), DISABLED(operational), DOWN Member Nodes: Node ID Node IP Health Master State ------------- ------ ------------ 1) 1 1.1.1.1* UP ACTIVE 2) 2 1.1.1.2 UNKNOWN UNKNOWN Done *local node
Related Commands add cluster instance rm cluster instance set cluster instance unset cluster instance enable cluster instance disable cluster instance
add cluster node

Synopsis add cluster node <nodeId> <IPAddress> [-state <state>] [-backplane <interface_name>] Description Add a node to a cluster. Arguments nodeId The unique number that identifies a node. Maximum value: 31 IPAddress The IP address of the node. state Active, Spare or Passive. An active node serves traffic. A spare node serves as a backup for active nodeds. A passive node does not serve traffic. This may be useful during temporary maintenance activity where it is desirable that the node takes part in the consensus protocol, but not serve traffic. Possible values: ACTIVE, SPARE, PASSIVE Default value: NSACL_NODEST_PASSIVE backplane Backplane Interface. Minimum value: 1
Example
Related Commands set cluster node unset cluster node rm cluster node show cluster node
set cluster node

Synopsis set cluster node <nodeId> [-state <state>] [-backplane <interface_name>] Description Set the parameters of a node that belongs to a cluster. Arguments nodeId The unique number that identifies a node. Maximum value: 31 state Active, Spare or Passive. An active node serves traffic. A spare node serves as a backup for active nodeds. A passive node does not serve traffic. This may be useful during temporary maintenance activity where it is desirable that the node takes part in the consensus protocol, but not serve traffic. Possible values: ACTIVE, SPARE, PASSIVE Default value: NSACL_NODEST_PASSIVE backplane Backplane Interface. Minimum value: 1 Example
Related Commands add cluster node unset cluster node rm cluster node show cluster node
unset cluster node

Synopsis unset cluster node <nodeId> [-state] [-backplane] Description Use this command to remove cluster node settings.Refer to the set cluster node command for meanings of the arguments.
Arguments Example
Related Commands add cluster node set cluster node rm cluster node show cluster node
rm cluster node
Synopsis rm cluster node <nodeId> Description Remove a node from the cluster. Arguments nodeId The unique number that identifies a node. Maximum value: 31 Example
Related Commands add cluster node set cluster node unset cluster node show cluster node
show cluster node

Synopsis show cluster node [<nodeId>] Description Display information about all the nodes in the specified cluster. Arguments nodeId The unique number that identifies the node. Default value: 255 Maximum value: 31 summary fullValues format
level IPAddress The IP Address of the node. flags The flags for this entry. clusterHealth Node clusterd state. effectiveState Node effective health state. operationalSyncState Node Operational Reconciliation state. masterState Node Master state. health Node Health state. state Active, Spare or Passive. An active node serves traffic. A spare node serves as a backup for active nodeds. A passive node does not serve traffic. This may be useful during temporary maintenance activity where it is desirable that the node takes part in the consensus protocol, but not serve traffic. backplane Backplane Interface. isCCO This argument is used to determine whether the node is CCO. isLocalnode This argument is used to determine whether it is local node. count stateflag Example An example of the command's output is as follows: 1)Node ID: 1 Cluster ID: 1 IP: 1.1.1.1* State: ACTIVE Backplane: 1/1/1 Health: UP Master State: ACTIVE Sync State: DISABLED Done *local node Related Commands add cluster node set cluster node unset cluster node rm cluster node
sync cluster files

Synopsis sync cluster files [<Mode> ...]
Description Synchronize SSL Certificates, SSL CRL lists, SSL VPN bookmarks, and other files from the CCO to other cluster nodes. This command must be executed only from the cluster IP address. This command will be automatically triggered from the CCO when a new node is added to a cluster and periodically during the lifetime of the cluster, to synchronize updated files between the cluster nodes. Note: Files on non-CCO nodes are not deleted if they do no not exist on the CCO. The command can be configured to synchronize directories or files which are specified by the following modes: Mode Paths all /nsconfig/ssl/ /var/netscaler/ssl/ /var/vpn/bookmark/ /nsconfig/dns/ /nsconfig/ htmlinjection/ /netscaler/htmlinjection/ens/ /nsconfig/monitors/ /nsconfig/nstemplates/ /nsconfig/ssh/ /nsconfig/ rc.netscaler /nsconfig/resolv.conf /nsconfig/inetd.conf /nsconfig/syslog.conf /nsconfig/snmpd.conf /nsconfig/ ntp.conf /nsconfig/httpd.conf /nsconfig/sshd_config /nsconfig/hosts /nsconfig/enckey /var/nslw.bin/etc/krb5.conf /var/ nslw.bin/etc/krb5.keytab /var/lib/likewise/db/ /var/download/ /var/wi/tomcat/webapps/ /var/wi/tomcat/conf/Catalina/ localhost/ /var/wi/java_home/lib/security/cacerts /var/wi/java_home/jre/lib/security/cacerts ssl /nsconfig/ssl/ /var/ netscaler/ssl/ bookmarks /var/vpn/bookmark/ dns /nsconfig/dns/ htmlinjection /nsconfig/htmlinjection/ imports /var/ download/ misc /nsconfig/license/ /nsconfig/rc.conf all_plus_misc Includes *all* files and /nsconfig/license/ and / nsconfig/rc.conf. Arguments Mode Specifies the directories and files to be synchronized. Possible values: all, bookmarks, ssl, htmlinjection, imports, misc, dns, all_plus_misc. Default value: all Example sync cluster files ssl or sync cluster files all
Related Commands
Chapter
14
Compression Commands
Topics: stat cmp add cmp action rm cmp action show cmp action rename cmp action add cmp policy rm cmp policy set cmp policy unset cmp policy show cmp policy stat cmp policy rename cmp policy add cmp policylabel rm cmp policylabel bind cmp policylabel unbind cmp policylabel show cmp policylabel stat cmp policylabel rename cmp policylabel show cmp stats bind cmp global unbind cmp global show cmp global set cmp parameter unset cmp parameter show cmp parameter
404 | Citrix NetScaler 10 | Compression Commands
stat cmp
Synopsis stat cmp [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display compression statistics. Arguments Bandwidth saving (%) (DlBndSav) Bandwidth saving from delta compression expressed as percentage. Delta compression ratio (DlCmpRt) Ratio of compressible data received to compressed data transmitted.If this ratio is one (uncmp:1.0) that means compression is disabled or we are not able to compress even a single compressible packet. Decompression ratio (DTCmpRt) Ratio of decompressed data transmitted to compressed data received. Bandwidth saving (%) (DBndSav) Bandwidth saving from TCP compression expressed as percentage. TCP compression ratio (TCmpRt) Ratio of compressible data received to compressed data transmitted.If this ratio is one (uncmp:1.0) that means compression is disabled or we are not able to compress even a single compressible packet. TCP Bandwidth saving (%) (BndSav) Bandwidth saving from TCP compression expressed as percentage. Total HTTP compression ratio Ratio of total HTTP data received to total HTTP data transmitted. HTTP Bandwidth saving (%) (HttpBndSav) Bandwidth saving from TCP compression expressed as percentage. HTTP compression ratio Ratio of the compressible data received from the server to the compressed data sent to the client. HTTP compression requests Number of HTTP compression requests the NetScaler receives for which the response is successfully compressed. For example, after you enable compression and configure services, if you send requests to the NetScaler with the following header information: "Accept-Encoding: gzip, deflate", and NetScaler compresses the corresponding response, this counter is incremented. Compressible bytes received Number of bytes that can be compressed, which the NetScaler receives from the server. This gives the content length of the response that the NetScaler receives from server. Compressed bytes transmitted Number of bytes the NetScaler sends to the client after compressing the response from the server. Compressible packets received Number of HTTP packets that can be compressed, which the NetScaler receives from the server. Compressed packets transmitted Number of HTTP packets that the NetScaler sends to the client after compressing the response from the server. Compressible bytes received (TCmpRxB)
Citrix NetScaler 10 | Compression Commands | 405
Number of bytes that can be compressed, which the NetScaler receives from the server. This gives the content length of the response that the NetScaler receives from server. Compressible packets received (TCmpRxP) Total number of compressible packets received by NetScaler. Compressed bytes transmitted (TCmpTxB) Number of bytes that the NetScaler sends to the client after compressing the response from the server. Compressed packets transmitted (TCmpTxP) Number of TCP packets that the NetScaler sends to the client after compressing the response from the server. Quantum compression (TCmpQuan) Number of times the NetScaler compresses a quantum of data. NetScaler buffers the data received from the server till it reaches the quantum size and then compresses the buffered data and transmits to the client. Push flag compression (TCmpPush) Number of times the NetScaler compresses data on receiving a TCP PUSH flag from the server. The PUSH flag ensures that data is compressed immediately without waiting for the buffered data size to reach the quantum size. End Of Input compression (TCmpEoi) Number of times the NetScaler compresses data on receiving End Of Input (FIN packet). When the NetScaler receives End Of Input (FIN packet), it compresses the buffered data immediately without waiting for the buffered data size to reach the quantum size. Timer compression (TCmpTmr) Number of times the NetScaler compresses data on expiration of data accumulation timer. The timer expires if the server response is very slow and consequently, the NetScaler does not receive response for a certain amount of time. Under such a condition, the NetScaler compresses the buffered data immediately without waiting for the buffered data size to reach the quantum size. Compressed bytes received (DCmpTRxB) Total number of compressed bytes received by NetScaler. Compressed packets received (DCmpTRxP) Total number of compressed packets received by NetScaler. Decompressed bytes transmitted (DCmpTTxB) Total number of decompressed bytes transmitted by NetScaler. Decompressed packets transmitted (DCmpTTxP) Total number of decompressed packets transmitted by NetScaler. Wrong data (DCmpErrD) Number of data errors encountered while decompressing. Less Data (DCmpErrL) Number of times NetScaler received less data than declared by protocol. More Data (DCmpErrM) Number of times NetScaler received more data than declared by protocol. Memory failures (DCmpMem) Number of times memory failures occurred while decompressing. Unknown (DCmpErrU) Number of times unknown errors occurred while decompressing.
Delta compression requests (DlCmpRx) Total number of delta compression requests received by NetScaler. Delta compression applied (DlDone) Total number of delta compressions done by NetScaler. Compressible bytes received (DlCmpRxB) Total number of delta-compressible bytes received by NetScaler. Compressed bytes transmitted (DlCmpTxB) Total number of delta-compressed bytes transmitted by NetScaler. First-time access (DlCmpFAc) Total number of delta compression first accesses. Compressible packets received (DlCmpRxP) Number of delta-compressible packets received. Compressed packets transmitted (DlCmpTxP) Total number of delta-compressed packets transmitted by NetScaler. Basefile requests served (DlCBSrv) Total number of basefile requests served by NetScaler. Basefile bytes transmitted (DlCBTxB) Number of basefile bytes transmitted by NetScaler. Delta compression bypassed (DlCmpEBy) Number of times delta-compression bypassed by NetScaler. Basefile write header failed (DlCmpEBW) Number of times basefile could not be updated in NetScaler cache. Basefile no-store miss (DlCmpENM) Number of times basefile was not found in NetScaler cache. Request information too big (DlCmpERB) Number of times basefile request URL was too large. Request info alloc failed (DlCmpERF) Number of times requested basefile could not be allocated. Session allocation failed (DlCmpESF) Number of times delta compression session could not be allocated. Response bytes received (HTRspbRx) Total number of bytes of HTTP response data received. Example
Related Commands stat cmp policy stat cmp policylabel
add cmp action

Synopsis add cmp action <name> <cmpType>
Description Create a compression action. The action thus created can be associated with the compression policy. The builtin compression actions NOCOMPRESS/COMPRESS/GZIP/DEFLATE are always present on the system. These actions are: NOCOMPRESS action - can be used to define a policy that disables compression for the matching policy.COMPRESS action - can be used to enable compression for a specific policy. This action will do GZIP or DEFLATE, based on the browser. GZIP action - can be used to enable GZIP compression for a specific policy. With this action, GZIP compression will be performed if the browser supports GZIP, other wise compression is disabled. DEFLATE action - can be used to enable DEFLATE compression for a specific policy. With this action, DEFLATE compression will be performed if the browser supports DEFLATE, otherwise compression is disabled. Arguments name The name of the compression action. cmpType The type of compression action. Possible values: compress, gzip, deflate, nocompress deltaType The type of delta action (if delta type compression action is defined). Possible values: PERURL, PERPOLICY Default value: NS_ACT_CMP_DELTA_TYPE_PERURL Example add cmp action nocmp NOCOMPRESS Related Commands rm cmp action show cmp action rename cmp action
rm cmp action
Synopsis rm cmp action <name> Description Remove the specified compression action. Arguments name The name of the compression action. Example rm cmp action cmp_action_name Related Commands add cmp action show cmp action rename cmp action
show cmp action

Synopsis show cmp action [<name>]
Description Display the compression actions defined including the built-in actions. Arguments name The name of the compression action. summary fullValues format level cmpType The type of compression action. deltaType The type of delta action if compression type is delta compression. stateflag isDefault A value of true is returned if it is a default cmpaction. flags count Example Example 1 The following example shows output from the show cmp action command when no custom cmp actions have been defined: > show cmp action 3 Compression actions: 1) Name: GZIP Compression Type: gzip 2) Name: NOCOMPRESS Compression Type: nocompress 3) Name: DEFLATE Compression Type: deflate 4) Name: COMPRESS Compression Type: compress Done Done Example 2 The following command creates a compression action: add cmp action nocmp NOCOMPRESS The following example shows output from the show cmp action command after the previous command has been issued: > show cmp action 3 Compression actions: 1) Name: GZIP Compression Type: gzip 2) Name: NOCOMPRESS Compression Type: nocompress 3) Name: DEFLATE Compression Type: deflate 4) Name: COMPRESS Compression Type: compress 1 Compression action: 1) Name: nocmp Compression Type: nocompress Done Related Commands add cmp action rm cmp action rename cmp action
rename cmp action

Synopsis rename cmp action <name>@ <newName>@ Description Rename a cmp action.
Arguments name The name of the cmp action. newName The new name of the cmp action. Example rename cmp policy oldname newname Related Commands add cmp action rm cmp action show cmp action
add cmp policy

Synopsis add cmp policy <name> -rule <expression> -resAction <string> Description Create a HTTP compression policy. Arguments name The name of the HTTP compression policy to be created. rule The rule associated with the HTTP compression policy. resAction The compression action that needs to be performed when the rule matches. The string value can be either be a created compression action (user-defined) or one of the following built-in compression actions: NOCOMPRESS action - can be used to define a policy that disables compression for the matching policy.COMPRESS action - can be used to enable compression for a specific policy. This action will do GZIP or DEFLATE, based on the browser. GZIP action - can be used to enable GZIP compression for a specific policy. With this action, GZIP compression will be performed if the browser supports GZIP, other wise compression is disabled. DEFLATE action - can be used to enable DEFLATE compression for a specific policy. With this action, DEFLATE compression will be performed if the browser supports DEFLATE, otherwise compression is disabled. Example Example 1: add cmp policy pdf_cmp -rule "RES.HTTP.HEADER Content-Type CONTAINS application/pdf" -resAction COMPRESS After creating the above compression policy, you must activate it by binding it globally: bind cmp global pdf_cmp The NetScaler system will use the configured pdf_cmp compression policy to perform compression of pdf files. Example 2: The following command disables compression for all the access from the specific subnet. add cmp policy local_sub_nocmp -rule "SOURCEIP == 10.1.1.0 -netmask 255.255.255.0" -resAction NOCOMPRESS bind cmp global local_sub_nocmp Related Commands rm cmp policy
set cmp policy unset cmp policy show cmp policy stat cmp policy rename cmp policy
rm cmp policy
Synopsis rm cmp policy <name> Description Remove a HTTP compression policy. Arguments name The name of the HTTP compression policy to be removed. Example rm cmp policy cmp_policy_name The "show cmp policy" command shows all currently defined HTTP compression policies. Related Commands add cmp policy set cmp policy unset cmp policy show cmp policy stat cmp policy rename cmp policy
set cmp policy

Synopsis set cmp policy <name> [-rule <expression>] [-resAction <string>] Description Modify a HTTP compression policy. Use the "show cmp policy" command to view all configured HTTP compression policies. Arguments name The name of the HTTP compression policy to be modified. rule The new rule to be associated with the HTTP compression policy. resAction The compression action to be associated with the HTTP compression policy.
Example Example 1: add cmp policy pdf_cmp -rule "RES.HTTP.HEADER Content-Type CONTAINS application/pdf" -resAction COMPRESS After creating the above compression policy, you must activate it by binding it globally: bind cmp global pdf_cmp The NetScaler system will use the configured pdf_cmp compression policy to perform compression for pdf files. To disable pdf compression for Internet Explorer, you can change the above compression policy by issuing the following command: set cmp policy pdf_cmp -rule "RES.HTTP.HEADER Content-Type CONTAINS application/pdf && RES.HTTP.HEADER User-Agent NOTCONTAINS MSIE" To view the changed cmp policy, enter the following command: >show cmp policy pdf_cmp Name: pdf_cmp Rule: (RES.HTTP.HEADER Content-Type CONTAINS application/pdf && REQ.HTTP.HEADER User-Agent NOTCONTAINS MSIE) Response action: COMPRESS Hits: 2 Bytes In:...609284 Bytes Out:... 443998 Bandwidth saving...27.13% Ratio 1.37:1 Done Related Commands add cmp policy rm cmp policy unset cmp policy show cmp policy stat cmp policy rename cmp policy
unset cmp policy

Synopsis unset cmp policy <name> [-rule] [-resAction] Description Use this command to remove cmp policy settings.Refer to the set cmp policy command for meanings of the arguments. Arguments Example
Related Commands add cmp policy rm cmp policy set cmp policy show cmp policy stat cmp policy rename cmp policy
show cmp policy

Synopsis show cmp policy [<name>] show cmp policy stats - alias for 'stat cmp policy'
Description Display the configured HTTP compression policies. Arguments name The name of the HTTP compression policy whose details are to be displayed. summary fullValues format level stateflag PolicyType rule The request/response rule that will trigger the specified compression action. reqAction The compression action to be performed on requests. resAction The compression action to be performed on responses. hits Number of hits. txbytes Number of bytes transferred. rxbytes Number of bytes received. clientTTLB Total client TTLB value. clientTransactions Number of client transactions. serverTTLB Total server TTLB value. serverTransactions Number of server transactions. piHits Number of hits. piTxBytes Number of bytes transferred. piRxBytes Number of bytes received. piCltTTLB Total client TTLB value. piCltTransactions Number of client transactions.
piSvrTTLB Total server TTLB value. piSvrTransactions Number of server transactions. boundTo The name of the entity to which the policy is bound. activePolicy priority gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policy bindPolicyType policyType isDefault A value of true is returned if it is a default cmppolicy. expressionType Type of policy (Classic/Advanced) vserverType count Example > show cmp policy 4 Compression policies: 1) Name: ns_cmp_content_type Rule: ns_content_type Response action: COMPRESS Hits: 1 Bytes In:...4325 Bytes Out:... 1530 Bandwidth saving...64.62% Ratio 2.83:1 2) Name: ns_cmp_msapp Rule: (ns_msie && ns_msword || (ns_msexcel || ns_msppt)) Response action: COMPRESS Hits: 7 Bytes In:...796160 Bytes Out:... 197730 Bandwidth saving...75.16% Ratio 4.03:1 3) Name: ns_cmp_mscss Rule: (ns_msie && ns_css) Response action: COMPRESS Hits: 0 4) Name: ns_nocmp_mozilla_47 Rule: (ns_mozilla_47 && ns_css) Response action: NOCOMPRESS Hits: 0 Done You can also view an individual cmp policy by giving the cmp policy name as an argument: > show cmp policy ns_cmp_msapp Name: ns_cmp_msapp Rule: (ns_msie && ns_msword || (ns_msexcel || ns_msppt)) Response action: COMPRESS Hits: 7 Bytes In:...796160 Bytes Out:... 197730 Bandwidth saving...75.16% Ratio 4.03:1 Done Related Commands add cmp policy rm cmp policy set cmp policy unset cmp policy
stat cmp policy rename cmp policy
stat cmp policy

Synopsis stat cmp policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display cmp policy statistics. Arguments name The name of the compress policy for which statistics will be displayed. If not given statistics are shown for all compress policies. count devno stateflag Policy hits (Hits) Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example stat cmp policy Related Commands add cmp policy rm cmp policy set cmp policy unset cmp policy show cmp policy rename cmp policy stat cmp stat cmp policylabel
rename cmp policy

Synopsis rename cmp policy <name>@ <newName>@ Description Rename a cmp policy. Arguments name
The name of the cmp policy. newName The new name of the cmp policy. Example rename cmp policy oldname newname Related Commands add cmp policy rm cmp policy set cmp policy unset cmp policy show cmp policy stat cmp policy
add cmp policylabel

Synopsis add cmp policylabel <labelName> -type ( REQ | RES ) Description Create a HTTP compression policy label. Arguments labelName The name of the HTTP compression policy label to be created. type Specifies when policies bound to this policy label will be evaluated. Possible values: REQ, RES Example add cmp policylabel cmp_pol_label -type REQ Related Commands rm cmp policylabel bind cmp policylabel unbind cmp policylabel show cmp policylabel stat cmp policylabel rename cmp policylabel
rm cmp policylabel
Synopsis rm cmp policylabel <labelName>
Description Remove a HTTP compression policy label. Arguments labelName The name of the HTTP compression policy label to be removed. Example rm cmp policylabel cmp_pol_label
Related Commands add cmp policylabel bind cmp policylabel unbind cmp policylabel show cmp policylabel stat cmp policylabel rename cmp policylabel
bind cmp policylabel

Synopsis bind cmp policylabel <labelName> -policyName <string> -priority <positive_integer> [-gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] Description Bind an ADVANCED HTTP compression policy to a HTTP compression policy label. Arguments labelName Name of the HTTP compression policy label. policyName The HTTP compression policy name. Example bind cmp policylabel cmp_pol_label -policyName cmp_pol -priority 1
Related Commands add cmp policylabel rm cmp policylabel unbind cmp policylabel show cmp policylabel stat cmp policylabel rename cmp policylabel
unbind cmp policylabel

Synopsis unbind cmp policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind an ADVANCED HTTP compression policy from a HTTP compression policy label. Arguments labelName Name of the HTTP compression policy label. policyName The HTTP compression policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind cmp policylabel cmp_pol_label cmp_pol
Related Commands add cmp policylabel rm cmp policylabel bind cmp policylabel show cmp policylabel stat cmp policylabel rename cmp policylabel
show cmp policylabel

Synopsis show cmp policylabel [<labelName>] Description Display all HTTP compression policy labels or all policies bound to a HTTP compression policy label. Arguments labelName The name of the HTTP compression policy label. summary fullValues format level stateflag
type Specifies when policies bound to this policy label will be evaluated. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The compression policy name. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound compression policy. description Description of the policylabel flags count Example i) show cmp policylabel cmp_pol_label ii) show cmp policylabel
Related Commands add cmp policylabel rm cmp policylabel bind cmp policylabel unbind cmp policylabel stat cmp policylabel rename cmp policylabel
stat cmp policylabel

Synopsis stat cmp policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of cmp policylabel(s).
Arguments labelName The name of the compress policy label for which statistics will be displayed. If not given statistics are shown for all compress policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add cmp policylabel rm cmp policylabel bind cmp policylabel unbind cmp policylabel show cmp policylabel rename cmp policylabel stat cmp stat cmp policy
rename cmp policylabel

Synopsis rename cmp policylabel <labelName>@ <newName>@ Description Rename a cmp policy label. Arguments labelName The name of the cmp policylabel. newName The new name of the cmp policylabel. Example rename cmp policylabel oldname newname
Related Commands add cmp policylabel rm cmp policylabel
bind cmp policylabel unbind cmp policylabel show cmp policylabel stat cmp policylabel
show cmp stats

Synopsis show cmp stats - alias for 'stat cmp' Description show cmp stats is an alias for stat cmp Arguments Example
Related Commands stat cmp
bind cmp global

Synopsis bind cmp global <policyName> [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] [gotoPriorityExpression <expression>] [-type <type>] [-invoke (<labelType> <labelName>) ] Description Activate the compression policy globally. Note that for compression feature to work, a compression license is required. To activate the compression feature, use the "enable ns feature cmp" command. When you enable the compression feature, all of the built-in compression policies are bound globally. Arguments policyName The name of the HTTP compression policy. Example add cmp policy pdf_cmp -rule "RES.HTTP.HEADER Content-Type CONTAINS application/ pdf" -resAction COMPRESS After creating the above compression policy, you must activate it by binding it globally: bind cmp global pdf_cmp After binding pdf_cmp compression policy globally, the policy gets activated and the NetScaler system will perform compression for the pdf files. To view the globally active compression policies, enter the following command: > show cmp global 5 Globally Active Compression Policies: 1) Policy Name: ns_cmp_content_type Priority: 0 2) Policy Name: ns_nocmp_mozilla_47 Priority: 0 3) Policy Name: ns_cmp_mscss Priority: 0 4) Policy Name: ns_cmp_msapp Priority: 0 5) Policy Name: pdf_cmp Priority: 0 Done
Related Commands unbind cmp global
show cmp global
unbind cmp global

Synopsis unbind cmp global <policyName> [-type <type> [-priority <positive_integer>]] Description Deactivate a globally bound HTTP compression policy. Arguments policyName The name of the globally bound HTTP compression policy to be deactivated. Example To view the globally active compression policies, enter the following command: > show cmp global 5 Globally Active Compression Policies: 1) Policy Name: ns_cmp_content_type Priority: 0 2) Policy Name: ns_nocmp_mozilla_47 Priority: 0 3) Policy Name: ns_cmp_mscss Priority: 0 4) Policy Name: ns_cmp_msapp Priority: 0 5) Policy Name: pdf_cmp Priority: 0 Done To deactivate this globally active compression policy on the NetScaler system, enter the following command: unbind cmp global pdf_cmp
Related Commands bind cmp global show cmp global
show cmp global

Synopsis show cmp global [-type <type>] Description Display the globally bound HTTP compression policies. Arguments type The bindpoint to which the policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT, RES_OVERRIDE, RES_DEFAULT summary fullValues format level stateflag policyName The name of the globally bound HTTP compression policy.
priority The priority assigned to the policy binding. state The current state of the policy binding. This attribute is relevant only for CLASSIC policies. numpol The number of policies bound to the bindpoint. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE invoke Invoke flag. This attribute is relevant only for ADVANCED policies labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. count Example > show cmp global 4 Globally Active Compression Policies: 1) Policy Name: ns_cmp_content_type Priority: 0 2) Policy Name: ns_nocmp_mozilla_47 Priority: 0 3) Policy Name: ns_cmp_mscss Priority: 0 4) Policy Name: ns_cmp_msapp Priority: 0 Done
Related Commands bind cmp global unbind cmp global
set cmp parameter

Synopsis set cmp parameter [-cmpLevel <cmpLevel>] [-quantumSize <positive_integer>] [-serverCmp ( ON | OFF )] [minResSize <positive_integer>] [-cmpBypassPct <positive_integer>] [-cmpOnPush ( ENABLED | DISABLED )] [policyType ( CLASSIC | ADVANCED )] [-addVaryHeader ( ENABLED | DISABLED )] [-externalCache ( YES | NO )] Description Configurable parameters for compression. Arguments cmpLevel Compression level. Possible values: optimal, bestspeed, bestcompression Default value: NSCMPLVL_OPTIMAL quantumSize Minimum amount of data to compress as one unit. Default value: 57344 Minimum value: 8 Maximum value: 63488 serverCmp Compression at back-end server. Possible values: ON, OFF Default value: ON
heurExpiry Heuristic basefile expiry. Possible values: ON, OFF Default value: OFF heurExpiryThres Threshold compression ratio for heuristic basefile expiry, multiplied by 100. For example, to set the threshold ratio to 1.25, specify 125. Default value: 100 Minimum value: 1 Maximum value: 1000 heurExpiryHistWt For heuristic basefile expiry, weightage to be given to historical delta compression ratio, specified as percentage. For example, to give 25% weightage to historical ratio (and therefore 75% weightage to the ratio for current delta compression transaction), specify 25. Default value: 50 Minimum value: 1 Maximum value: 100 minResSize Size of the smallest HTTP response that will be compressed. cmpBypassPct CPU usage (%) at which NetScaler should start progressively bypassing compression on HTTP requests. Default value: 100 Maximum value: 100 cmpOnPush Enable/disable compression on PUSH packet Possible values: ENABLED, DISABLED Default value: DISABLED policyType The type of the HTTP compression global policy bindings to be used for virtual servers that have no HTTP compression policies bound. Possible values: CLASSIC, ADVANCED Default value: NS_EXPR_TYPE_CLASSIC addVaryHeader Enable/disable vary header insertion during compression for HTTP/1.1 client. Possible values: ENABLED, DISABLED Default value: DISABLED externalCache Enable insertion of Cache-Control: private response directive to indicate response message is intended for a single user and must not be cached by a shared or proxy cache. Possible values: YES, NO Default value: NO Example set cmp param -cmpLevel bestspeed -quantumSize 20480
Related Commands unset cmp parameter show cmp parameter
unset cmp parameter

Synopsis unset cmp parameter [-cmpLevel] [-quantumSize] [-serverCmp] [-minResSize] [-cmpBypassPct] [-cmpOnPush] [policyType] [-addVaryHeader] [-externalCache] Description Use this command to remove cmp parameter settings.Refer to the set cmp parameter command for meanings of the arguments.
Arguments Example
Related Commands set cmp parameter show cmp parameter
show cmp parameter

Synopsis show cmp parameter Description Display configurable parameters for compression. Arguments format level cmpLevel Compression level. quantumSize Minimum amount of data to compress as one unit. serverCmp Compression enabled/disabled at back-end server. heurExpiry Heuristic basefile expiry. heurExpiryThres Threshold compression ratio for heuristic basefile expiry, multiplied by 100. For example, to set the threshold ratio to 1.25, specify 125. heurExpiryHistWt For heuristic basefile expiry, weightage to be given to historical delta compression ratio, specified as percentage. For example, to give 25% weightage to historical ratio (and therefore 75% weightage to the ratio for current delta compression transaction), specify 25. minResSize Size of the smallest HTTP response that will be compressed. cmpBypassPct CPU usage (%) at which NetScaler should start progressively bypassing compression on HTTP requests. cmpOnPush Enable/disable compression on PUSH packet policyType The type of the HTTP compression global policy bindings to be used for virtual servers that have no HTTP compression policies bound.
addVaryHeader Enable/disable vary header insertion during compression for HTTP/1.1 client. externalCache Enable insertion of Cache-Control: private response directive to indicate response message is intended for a single user and must not be cached by a shared or proxy cache. Example
Related Commands set cmp parameter unset cmp parameter
Chapter
15
Cache Redirection Commands
Topics: add cr policy rm cr policy set cr policy show cr policy add cr vserver rm cr vserver set cr vserver unset cr vserver bind cr vserver unbind cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
428 | Citrix NetScaler 10 | Cache Redirection Commands
add cr policy
Synopsis add cr policy <policyName> -rule <expression> Description Add a cache redirection policy. To associate the policy created with a cache redirection virtual server, use the ###bind cr vserver#### command. Arguments policyName The name of the cache redirection policy. rule A condition defined by an expression. When the condition is valid, the request is directed to the origin server. Expression logic is: expression names, separated by the logical operators || and &&, and possibly grouped using parenthesis. Note: If the expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are valid expressions: l ns_ext_cgi||ns_ext_asp 2 ns_non_get && (ns_header_cookie||ns_header_pragma) Example
Related Commands add policy map rm policy map show policy map add policy expression rm policy expression show policy expression add cr vserver bind cr vserver set cr vserver show cr vserver unbind cr vserver unset cr vserver rm cr policy set cr policy show cr policy
rm cr policy
Synopsis rm cr policy <policyName>
Citrix NetScaler 10 | Cache Redirection Commands | 429
Description Remove a Cache Redirection policy. You can delete a user-defined cache redirection policy that is not bound to a cache redirection virtual server. If the policy is bound to a virtual server, you must first unbind the policy, and then remove it from the system. Arguments policyName The name of the cache policy to be removed. You cannot remove a positive cacheability policy/ content group if it has been configured as the target of a dynamic invalidation policy. In this case, to remove the policy, you must use the following procedure, which removes the dynamic invalidation policy and the action associated with the dynamic invalidation policy: a. Enter the ###show cache action### command at the system prompt. This will display all cache actions. b. Identify the action in which the contentGroupPolicy attribute matches the policy you want to remove. Enter the ###show cache policy### command at the system prompt. c. Identify the policies that the action you chose in step (b) is associated with. d. Remove the policies you identified in step (c). Enter the ###rm cache policy### command. e. Remove the action you identified in step (b). Enter the ###rm cache action### command. Example Related Commands add policy map rm policy map show policy map add policy expression rm policy expression show policy expression add cr vserver bind cr vserver set cr vserver show cr vserver unbind cr vserver unset cr vserver add cr policy set cr policy show cr policy
set cr policy
Synopsis set cr policy <policyName> -rule <expression> Description Changes the rule for a cache redirection policy. Arguments policyName The name of the cache redirection policy.
rule The condition defined by an expression. When the condition is valid, the request is directed to the origin server. Expression logic is: expression names, separated by the logical operators || and &&, and possibly grouped using parenthesis. Note: If the expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are valid expressions: l ns_ext_cgi||ns_ext_asp 2 ns_non_get && (ns_header_cookie||ns_header_pragma) Example Related Commands add cr policy rm cr policy show cr policy
show cr policy
Synopsis show cr policy [<policyName>] Description Display all existing cache redirection policies. Arguments policyName The name of the cache redirection policy. summary fullValues format level rule A condition defined by an expression. When the condition is valid, the request is directed to the origin server. Expression logic is: expression names, separated by the logical operators || and &&, and possibly grouped using parenthesis. Note: If the expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are valid expressions: l ns_ext_cgi||ns_ext_asp 2 ns_non_get && (ns_header_cookie||ns_header_pragma) domain Domain name. vstype Virtual server type. count stateflag Example Related Commands add policy map
rm policy map show policy map add policy expression rm policy expression show policy expression add cr vserver bind cr vserver set cr vserver show cr vserver unbind cr vserver unset cr vserver add cr policy rm cr policy set cr policy
add cr vserver
Synopsis add cr vserver <name> <serviceType> [<IPAddress> <port> [-range <positive_integer>]] [-cacheType <cacheType>] [-redirect <redirect>] [-onPolicyMatch ( CACHE | ORIGIN )] [-redirectURL <URL>] [-cltTimeout <secs>] [-precedence ( RULE | URL )] [-arp ( ON | OFF )] [-map ( ON | OFF )] [-format ( ON | OFF )] [-via ( ON | OFF )] [-cacheVserver <string>] [-dnsVserverName <string>] [-destinationVServer <string>] [-domain <string>] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-reuse ( ON | OFF )] [-state ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-backupVServer <string>] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-l2Conn ( ON | OFF )] [-Listenpolicy <expression> [Listenpriority <positive_integer>]] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-srcIPExpr <expression>] [-originUSIP ( ON | OFF )] [-usePortRange ( ON | OFF )] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] [-icmpVsrResponse ( PASSIVE | ACTIVE )] Description Add a cache redirection virtual server. Arguments name Name of the cache redirection virtual server. serviceType The type of service handled by the virtual server. Note: Use service type HTTP to configure content switching on this virtual server. Possible values: HTTP, SSL, NNTP IPAddress The IP address of the cache redirection virtual server. 1. To specify a specific virtual server address, type its numeric value. 2. To specify a wildcard virtual server address, type an asterisk (*). cacheType The supported cache server type. Note: For this command to work, you must select one of the cache types. Possible values: TRANSPARENT, REVERSE, FORWARD Default value: CRD_TRANSPARENT redirect The redirect policy. The valid redirect policies are: l. CACHE - Directs all requests to the cache. 2. POLICY - Applies the cache redirection policy to determine whether the request should be directed
to the cache or to the origin. This is the default setting. 3. ORIGIN - Directs all requests to the origin server. Possible values: CACHE, POLICY, ORIGIN Default value: CRD_POLICY onPolicyMatch Decide where to redirect the requests if the cache redirection policy is hit. The valid options are: 1. CACHE - Directs all the requests to the cache if cache redirection policy is hit. 2. ORIGIN - Directs all requests to the origing server if the cache redirection policy is hit. Note: For this option to work, you must select the cache redirection type as POLICY. Possible values: CACHE, ORIGIN Default value: CRD_ORIGIN redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. You can enter up to 127 characters as the URL argument.WARNING!Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the add cs policy CLI command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system - then the user may not get the requested content. cltTimeout The timeout value in seconds for idle client connection Maximum value: 31536000 precedence You can use this argument only when configuring content switching on the specified virtual server. This argument applies only if the URL- and RULE-based policies have both been configured on the same virtual server. This argument specifies the type of policy (URL or RULE) that takes precedence on the content switching virtual server. The default setting is RULE. l URL - In this case, the incoming request is matched against the URL-based policies before it is matched against the rule-based policies. l RULE - In this case, the incoming request is matched against the rulebased policies before it is matched against the URL-based policies. For all URL-based policies, the precedence hierarchy is: 1. Domain and exact URL 2. Domain, prefix and suffix 3. Domain and suffix 4. Domain and prefix 5. Domain only 6. Exact URL 7. Prefix and suffix 8. Suffix only 9. Prefix only 10. Default Possible values: RULE, URL Default value: CS_PRIORITY_RULE arp ghost map format via Determines whether the system will insert a Via: header in the HTTP requests. Possible values: ON, OFF Default value: ON cacheVserver The name of the default target cache virtual server to which requests are redirected. dnsVserverName The name of the DNS virtual server used to resolve domain names arriving at the forward proxy virtual server. Note: This parameter applies only to forward proxy virtual servers, not reverse and transparent. destinationVServer The destination virtual server for a transparent or forward proxy cache redirection virtual server. All requests to the transparent or forward proxy cache redirection virtual server are directed to this destination virtual server. domain
The default domain for reverse proxies. Domains are configured in the system so that they direct an incoming request from a particular configured source domain to a particular configured target domain. There may be several configured pairs of source and target domains. You can select one pair to be the default. Then, if a source domain is not present in the host header or URL of an incoming request, the request will be sent to the target domain of the selected default pair. soPersistenceTimeOut soThreshold reuse Specifies whether TCP connections to cache or origin servers will be reused across client connections. Note: You should include this argument only if the service type argument is set to HTTP. The default setting is ON. If you set this argument to OFF and: -redirect is set to CACHE: TCP connections to the cache servers are not reused. -redirect is set to ORIGIN: TCP connections to the origin servers are not reused. -redirect is set to POLICY: TCP connections to the origin servers are not reused. If you set this argument to ON, connections are reused to both origin and cache servers. Possible values: ON, OFF Default value: ON state The initial state (enabled or disabled) of the cache redirection virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED downStateFlush Perform delayed cleanup of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED backupVServer The Backup Virtual Server. disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF Listenpolicy Use this parameter to specify the listen policy for CR Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of CR Vserver. Default value: 101 Maximum value: 100 tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. srcIPExpr Use this parameter to specify the expression used to extract the Source IP to be used from the requests coming from the Cache. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters.
originUSIP For requests going to the Origin specify whether to use the SourceIP or not. Possible values: ON, OFF usePortRange Select the source port for requests going to the origin. Possible values: ON, OFF appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example Related Commands add policy map rm policy map show policy map add policy expression rm policy expression show policy expression rm cr vserver set cr vserver unset cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
rm cr vserver
Synopsis rm cr vserver <name>@ ... Description Remove a virtual server. Arguments name The name of the virtual server to be removed. Example rm vserver cr_vip
Related Commands add cr vserver set cr vserver unset cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
set cr vserver
Synopsis set cr vserver <name> [-IPAddress <ip_addr|ipv6_addr|*>] [-redirect <redirect>] [-onPolicyMatch ( CACHE | ORIGIN )] [-precedence ( RULE | URL )] [-arp ( ON | OFF )] [-via ( ON | OFF )] [-cacheVserver <string>] [dnsVserverName <string>] [-destinationVServer <string>] [-domain <string>] [-reuse ( ON | OFF )] [-backupVServer <string>] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-redirectURL <URL>] [-cltTimeout <secs>] [downStateFlush ( ENABLED | DISABLED )] [-l2Conn ( ON | OFF )] [-Listenpolicy <expression>] [-Listenpriority <positive_integer>] [-tcpProfileName <string>] [-httpProfileName <string>] [-netProfile <string>] [-comment <string>] [-srcIPExpr <expression>] [-originUSIP ( ON | OFF )] [-usePortRange ( ON | OFF )] [-appflowLog ( ENABLED | DISABLED )] [-icmpVsrResponse ( PASSIVE | ACTIVE )] Description Change the attributes of a configured cache redirection vserver. Arguments name Name of the cache redirection virtual server. IPAddress The new IP address of the virtual server. redirect The redirect policy. Possible values: CACHE, POLICY, ORIGIN Default value: CRD_POLICY onPolicyMatch Decide where to redirect the requests if the cache redirection policy is hit. The valid options are: 1. CACHE - Directs all the requests to the cache if cache redirection policy is hit. 2. ORIGIN - Directs all requests to the origing server if the cache redirection policy is hit. Note: For this option to work, you must select the cache redirection type as POLICY. Possible values: CACHE, ORIGIN Default value: CRD_ORIGIN precedence The type of policy (URL or RULE) that takes precedence on the content redirection virtual server. Possible values: RULE, URL Default value: CS_PRIORITY_RULE arp via The state of the system in inserting a Via: header in the HTTP requests. Possible values: ON, OFF Default value: ON cacheVserver The name of the default target cache virtual server to which requests are to be redirected.
dnsVserverName The name of the DNS virtual server to be used to resolve domain names arriving at the forward proxy virtual server. destinationVServer The destination virtual server for the transparent or forward proxy cache redirection virtual server. domain The default domain for reverse proxies. reuse The state of reuse of TCP connections to the cache or origin servers across client connections. Possible values: ON, OFF Default value: ON backupVServer The Backup Virtual Server. disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED redirectURL The redirect URL. cltTimeout The client timeout value in seconds. Maximum value: 31536000 downStateFlush Perform delayed cleanup of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF Listenpolicy Use this parameter to specify the listen policy for CR Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of CR Vserver. Default value: 101 Maximum value: 100 tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. netProfile The name of the network profile. comment Comments associated with this virtual server. srcIPExpr Use this parameter to specify the expression used to extract the Source IP to be used from the requests coming from the Cache. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. originUSIP
For requests going to the Origin specify whether to use the SourceIP or not. Possible values: ON, OFF usePortRange Select the source port for requests going to the origin. Possible values: ON, OFF appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example Related Commands add cr vserver rm cr vserver unset cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
unset cr vserver
Synopsis unset cr vserver <name> [-cacheVserver] [-dnsVserver] [-destinationVServer] [-domainName] [-backupVServer] [-cltTimeout] [-redirectURL] [-l2Conn] [-originUSIP] [-usePortRange] [-srcIPExpr] [-tcpProfileName] [httpProfileName] [-appflowLog] [-netProfile] [-icmpVsrResponse] [-redirect] [-onPolicyMatch] [-precedence] [-arp] [-via] [-dnsVserverName] [-destinationVServer] [-domain] [-reuse] [-disablePrimaryOnDown] [-downStateFlush] [Listenpolicy] [-Listenpriority] [-comment] Description Unset the attributes of the configured cache redirection virtual server. To set the cache redirection virtual server attributes, you can use either the ###add cr vserver### or the ###set cr vserver### command..Refer to the set cr vserver command for meanings of the arguments. Arguments Example Related Commands rm policy map show policy map rm policy expression show policy expression rm cr policy show cr policy
add cr vserver rm cr vserver set cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
bind cr vserver
Synopsis bind cr vserver <name> -policyName <string> [<targetVserver>] Description For the system's cache redirection feature, this command binds the cache redirection policy to the cache redirection virtual server. Arguments name The name of the cache redirection virtual server to which the cache redirection policy will be bound. policyName The name of the cache redirection policy. This policy must be of the type map or cache redirection policy (created using the ###add policy map### or ###add cr policy### commands). Example Related Commands unbind cr vserver
unbind cr vserver
Synopsis unbind cr vserver <name> -policyName <string> Description This command unbinds a cache redirection policy from a cache redirection virtual server. Arguments name The name of the cache redirection virtual server from which to unbind the policy. policyName The name of the policy (previously created using the ###add cr policy### or ###add policy map### command). Example Related Commands rm policy map show policy map
rm policy expression show policy expression rm cr policy show cr policy bind cr vserver
enable cr vserver
Synopsis enable cr vserver <name>@ Description Enable a virtual server. Note: Virtual servers, when added, are enabled by default. Arguments name The name of the virtual server to be enabled. Example enable vserver cr_vip Related Commands add cr vserver rm cr vserver set cr vserver unset cr vserver disable cr vserver show cr vserver stat cr vserver rename cr vserver
disable cr vserver
Synopsis disable cr vserver <name>@ Description Disables a virtual server (takes it out of service). Arguments name The name of the virtual server to be disabled. Notes: 1. The system still responds to ARP and/or ping requests for the IP address of this virtual server. 2. Because the virtual server is still configured in the system, you can enable the virtual server using the ###enable vserver### command. Example disable vserver cr_vip Related Commands add cr vserver
rm cr vserver set cr vserver unset cr vserver enable cr vserver show cr vserver stat cr vserver rename cr vserver
show cr vserver
Synopsis show cr vserver [<name>] Description Display a specified cache redirection virtual server, or all configured cache redirection virtual servers. Arguments name The name of the cache redirection virtual server. summary fullValues format level IPAddress IPAddress The IP address of the virtual server. stateflag value The ssl card status for the transparent ssl cr vserver. port The port number of a service, or a virtual server, or a wildcard virtual server configured in the system. range Defines an IP address range. serviceType The type of service handled by the virtual server. Note: Use service type HTTP to configure content switching on this virtual server. type Virtual server type. state The state of the cr vserver. status Status. cacheType
The supported cache server type. Note: For this command to work, you must select one of the cache types. redirect The redirect policy. The valid redirect policies are: l. CACHE - Directs all requests to the cache. 2. POLICY - Applies the cache redirection policy to determine whether the request should be directed to the cache or to the origin. This is the default setting. 3. ORIGIN - Directs all requests to the origin server. onPolicyMatch Decide where to redirect the requests if the cache redirection policy is hit. The valid options are: 1. CACHE - Directs all the requests to the cache if cache redirection policy is hit. 2. ORIGIN - Directs all requests to the origing server if the cache redirection policy is hit. Note: For this option to work, you must select the cache redirection type as POLICY. precedence You can use this argument only when configuring content switching on the specified virtual server. This argument applies only if the URL- and RULE-based policies have both been configured on the same virtual server. This argument specifies the type of policy (URL or RULE) that takes precedence on the content switching virtual server. The default setting is RULE. l URL - In this case, the incoming request is matched against the URL-based policies before it is matched against the rule-based policies. l RULE - In this case, the incoming request is matched against the rulebased policies before it is matched against the URL-based policies. For all URL-based policies, the precedence hierarchy is: 1. Domain and exact URL 2. Domain, prefix and suffix 3. Domain and suffix 4. Domain and prefix 5. Domain only 6. Exact URL 7. Prefix and suffix 8. Suffix only 9. Prefix only 10. Default redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. You can enter up to 127 characters as the URL argument.WARNING!Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the add cs policy CLI command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system - then the user may not get the requested content. authentication Authentication. homePage Home page. dnsVserverName The name of the DNS virtual server used to resolve domain names arriving at the forward proxy virtual server. Note: This parameter applies only to forward proxy virtual servers, not reverse and transparent. domain The default domain for reverse proxies. Domains are configured in the system so that they direct an incoming request from a particular configured source domain to a particular configured target domain. There may be several configured pairs of source and target domains. You can select one pair to be the default. Then, if a source domain is not present in the host header or URL of an incoming request, the request will be sent to the target domain of the selected default pair. rule Rule. policyName Policies bound to this vserver. hits
Number of hits. serviceName Service name. weight Weight for this service. cacheVserver The name of the default target cache virtual server to which requests are redirected. targetVserver The CSW target server names. backupVServer The Backup Virtual Server. priority The priority for the policy. cltTimeout The timeout value in seconds for idle client connection soMethod The spillover factor. When the main virtual server reaches this spillover threshold, it will give further traffic to the backupvserver. soPersistence The state of spillover persistence. soPersistenceTimeOut The spillover persistence entry timeout. soThreshold The spillover threshold value. reuse Specifies whether TCP connections to cache or origin servers will be reused across client connections. Note: You should include this argument only if the service type argument is set to HTTP. The default setting is ON. If you set this argument to OFF and: -redirect is set to CACHE: TCP connections to the cache servers are not reused. -redirect is set to ORIGIN: TCP connections to the origin servers are not reused. -redirect is set to POLICY: TCP connections to the origin servers are not reused. If you set this argument to ON, connections are reused to both origin and cache servers. arp destinationVServer The destination virtual server for a transparent or forward proxy cache redirection virtual server. All requests to the transparent or forward proxy cache redirection virtual server are directed to this destination virtual server. via Determines whether the system will insert a Via: header in the HTTP requests. downStateFlush Perform delayed clean up of connections on this vserver. disablePrimaryOnDown Tells whether traffic will continue reaching backup vservers even after primary comes UP from DOWN state.
l2Conn Use L2 Parameters to identify a connection comment Comments associated with this virtual server. Listenpolicy The string is listenpolicy configured for CR vserver Listenpriority This parameter is the priority for listen policy of CR Vserver. tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. srcIPExpr Use this parameter to specify the expression used to extract the Source IP to be used from the requests coming from the Cache. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. originUSIP For requests going to the Origin specify whether to use the SourceIP or not. usePortRange Select the source port for requests going to the origin. appflowLog Enable logging appflow flow information netProfile The name of the network profile. icmpVsrResponse Can be active or passive count Example
Related Commands add policy map rm policy map show policy map add policy expression rm policy expression show policy expression show cs policy add cr vserver rm cr vserver set cr vserver
unset cr vserver enable cr vserver disable cr vserver stat cr vserver rename cr vserver
stat cr vserver
Synopsis stat cr vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display cache redirection vserver statistics. Arguments name The name of the vserver for which statistics will be displayed. If not given statistics are shown for all cr vservers. count devno stateflag IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Example
Related Commands add cr vserver
rm cr vserver set cr vserver unset cr vserver enable cr vserver disable cr vserver show cr vserver rename cr vserver
rename cr vserver
Synopsis rename cr vserver <name>@ <newName>@ Description Rename a cache redirection virtual server. Arguments name The name of the content switching virtual server. newName The new name of the virtual server. Example rename cr vserver vscr1 vscrnew
Related Commands add cr vserver rm cr vserver set cr vserver unset cr vserver enable cr vserver disable cr vserver show cr vserver stat cr vserver
Chapter
16
Content Switching Commands
Topics: add cs policy rm cs policy set cs policy unset cs policy show cs policy add cs policylabel rm cs policylabel bind cs policylabel unbind cs policylabel show cs policylabel add cs vserver rm cs vserver set cs vserver unset cs vserver bind cs vserver unbind cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver rename cs vserver
448 | Citrix NetScaler 10 | Content Switching Commands
add cs policy
Synopsis add cs policy <policyName> [-url <string> | -rule <expression>] [-domain <string>] Description Add a content switching policy. The policy created can be associated with a content switching virtual server using the bind cs vserver CLI command Arguments policyName The name of the new content switching policy. url The URL, with wildcards. Specify the string value in this format: // [[prefix ] [*]] [.suffix] rule The condition for applying this policy. Expression logic is as follows: - Expression names separated by the logical operators || and &&. - Expression names may be grouped using parenthesis. - If the expression contains blanks (e.g., between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following example shows valid expression logic: ns_ext_cgi||ns_ext_asp "ns_non_get && (ns_header_cookie||ns_header_pragma)" domain The domain name. The string value can range to 63 characters. Example To match the requests that have URL "/", you would enter the following command: add cs policy <policyName> -url / To match with all URLs that start with "/sports/", you would enter the following command: add cs policy <policyName> -url /sports/* To match requests with URLs that start with "/sports", you would enter the following command: add cs policy <policyName> -url /sports* To match requests with the URL "/sports/tennis/index.html", you would enter the following command: add cs policy <policyName> -url /sports/tennis/index.html To match requests that have URLs with the extension "jsp", you would enter the following command: add cs policy <policyName> -url /*.jsp To match requests with URLs that start with "/sports/" and the file extension "jsp", you would enter the following command: add cs policy <policyName> -url /sports/*.jsp To match requests with URLs that contain "sports", you would enter the following commands: add pol expression sports_url "URL contains sports" add cs policy <policyName> -rule sports_url To match requests with URL queries that contain "gold" or cookie headers that contain "gold", you would enter the following commands: add pol expression gold_query "URLQUERY contains gold" add pol expression gold_cookie "Header COOKIE contains gold" add cs policy <policyName> -rule "(gold_query ||gold_cookie)" To match requests with the domain name www.domainxyz.com, you enter the following command: add cs policy <policyName> -domain "www.domainxyz.com" To match requests with the domain name www.domainxyz.com and URLs with the extension "jsp", you would enter the following command: add cs policy <policyName> -url /*.jsp -domain "www.domainxyz.com" To match requests with the domain name www.domainxyz.com and URLs that contain "sports", you would enter the following commands: add pol expression sports_url "URL contains sports" add cs policy <policyName> -rule sports_url -domain "www.domainxyz.com" Related Commands rm cs policy set cs policy unset cs policy
Citrix NetScaler 10 | Content Switching Commands | 449
show cs policy
rm cs policy
Synopsis rm cs policy <policyName> Description Remove the specified content switching policy. Note: The policy must be unbound from the content switching virtual server before it is removed. Arguments policyName The name of the content switching policy to be removed. Example Related Commands add cs policy set cs policy unset cs policy show cs policy
set cs policy
Synopsis set cs policy <policyName> [-url <string> | -rule <expression>] [-domain <string>] Description Change a previously configured content switching policy. Arguments policyName Name of the policy. url The URL, with wildcards. rule The condition for applying this policy. domain The domain name. Example Related Commands add cs policy rm cs policy unset cs policy show cs policy
unset cs policy
Synopsis unset cs policy <policyName> [-url] [-rule] [-domain] Description Use this command to remove cs policy settings.Refer to the set cs policy command for meanings of the arguments. Arguments Example Related Commands add cs policy rm cs policy set cs policy show cs policy
show cs policy
Synopsis show cs policy [<policyName>] Description Display all of the content switching policies. Arguments policyName The name of the policy to be displayed. if no name is given then all policies will be displayed. summary fullValues format level url The URL with wildcards. rule The condition for applying this policy. domain The domain name. vstype Virtual server type. hits Total number of hits. piHits Total number of hits.
bindHits Total number of hits. labelName Name of the label invoked. labelType The invocation type. target Target flag priority priority of bound policy flag stateflag count Example Related Commands add cs policy rm cs policy set cs policy unset cs policy
add cs policylabel
Synopsis add cs policylabel <labelName> <cspolicylabeltype> Description Add a content switching policy label. Arguments labelName Name of the content switching policy label. cspolicylabeltype The type of the policy label. Possible values: HTTP, TCP, RTSP, SSL, SSL_TCP, UDP, DNS, SIP_UDP, ANY, RADIUS, RDP, MYSQL, MSSQL Example add cs policylabel trans_http_url HTTP Related Commands rm cs policylabel bind cs policylabel unbind cs policylabel show cs policylabel
rm cs policylabel
Synopsis rm cs policylabel <labelName> Description Remove a content switching policy label. Arguments labelName Name of the content switching policy label. Example rm cs policylabel trans_http_url Related Commands add cs policylabel bind cs policylabel unbind cs policylabel show cs policylabel
bind cs policylabel
Synopsis bind cs policylabel <labelName> <policyName> <priority> [-targetVserver <string> | -gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] Description Bind the content switching policy to one of the labels. Arguments labelName Name of the content switching policy label. policyName Name of the policy to be bound to content switching policy label. priority Priority with which the policy is to be bound. Minimum value: 1 Maximum value: 2147483647 targetVserver The virtual server name (created with the add lb vserver command) to which content will be switched. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. o If gotoPriorityExpression is not present or if it is equal to END then the policy bank evaluation ends here o Else if the gotoPriorityExpression is equal to NEXT then the next policy in the priority order is evaluated. t o Else gotoPriorityExpression is evaluated. The result of gotoPriorityExpression (which has to be a number) is processed as follows: - An UNDEF event is triggered if . gotoPriorityExpression cannot be evaluated . gotoPriorityExpression evaluates to number which is smaller than the maximum priority in the policy bank but is not same as any policy's priority . gotoPriorityExpression evaluates to a priority that is smaller than the current policy's priority - If the gotoPriorityExpression evaluates to the priority of the current policy then the next policy in the priority order is evaluated. - If the gotoPriorityExpression evaluates to the priority of a policy further ahead in the list then that policy will be evaluated next.
invoke Invoke flag. Example i) bind cs policylabel cs_lab lbvs_1 pol_cs 1 2 Related Commands add cs policylabel rm cs policylabel unbind cs policylabel show cs policylabel
unbind cs policylabel
Synopsis unbind cs policylabel <labelName> <policyName> Description Unbind entities from content switching label. Arguments labelName Name of the content switching policy label. policyName The name of the policy to be unbound. Example unbind cs policylabel cs_lab pol_cs Related Commands add cs policylabel rm cs policylabel bind cs policylabel show cs policylabel
show cs policylabel
Synopsis show cs policylabel [<labelName>] Description Display policy label or policies bound to content switching policylabel. Arguments labelName Name of the content switching policy label. summary fullValues format
level cspolicylabeltype The type of the policy label. stateflag numpol number of polices bound to label. hits Number of times policy label was invoked. policyName Name of the content switching policy. priority Specifies the priority of the policy. targetVserver The virtual server name (created with the add lb vserver command) to which content will be switched. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. invoke count Example i) show cs policylabel cs_lab ii) show cs policylabel Related Commands add cs policylabel rm cs policylabel bind cs policylabel unbind cs policylabel
add cs vserver
Synopsis add cs vserver <name> <serviceType> ((<IPAddress> [-range <positive_integer>]) | (-IPPattern <ippat> -IPMask <ipmask>)) <port> [-state ( ENABLED | DISABLED )] [-stateupdate ( ENABLED | DISABLED )] [-cacheable ( YES | NO )] [-redirectURL <URL>] [-cltTimeout <secs>] [-precedence ( RULE | URL )] [-caseSensitive ( ON | OFF )] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-redirectPortRewrite ( ENABLED | DISABLED )] [downStateFlush ( ENABLED | DISABLED )] [-backupVServer <string>] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-insertVserverIPPort <insertVserverIPPort> [<vipHeader>] ] [-rtspNat ( ON | OFF )] [-
AuthenticationHost <string>] [-Authentication ( ON | OFF )] [-Listenpolicy <expression> [-Listenpriority <positive_integer>]] [-authn401 ( ON | OFF )] [-authnVsName <string>] [-push ( ENABLED | DISABLED )] [pushVserver <string>] [-pushLabel <expression>] [-pushMultiClients ( YES | NO )] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-mssqlServerVersion <mssqlServerVersion>] [-l2Conn ( ON | OFF )] [-mysqlProtocolVersion <positive_integer>] [-mysqlServerVersion <string>] [-mysqlCharacterSet <positive_integer>] [-mysqlServerCapabilities <positive_integer>] [-appflowLog ( ENABLED | DISABLED )] [netProfile <string>] [-icmpVsrResponse ( PASSIVE | ACTIVE )] Description Add a content switching virtual server. Arguments name The content switching virtual server name. serviceType The service type of the virtual server. Possible values: HTTP, SSL, TCP, FTP, RTSP, SSL_TCP, UDP, DNS, SIP_UDP, ANY, RADIUS, RDP, MYSQL, MSSQL IPAddress The IP address of the virtual server. IPPattern The IP Pattern of the virtual server. range An IP address range. Default value: 1 Minimum value: 1 Maximum value: 254 port A port number for the virtual server. Minimum value: 1 state The initial state, enabled or disabled, of the virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED stateupdate To enable the state update for a CSW vserver Possible values: ENABLED, DISABLED Default value: DISABLED cacheable Use this option to specify whether a virtual server, used for load balancing or content switching, routes requests to the cache redirection virtual server before sending it to the configured servers. Possible values: YES, NO Default value: NO redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. You can enter up to 127 characters as the URL argument.WARNING!Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the add cs policy CLI command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system - then the user may not get the requested content. cltTimeout The timeout value in seconds for idle client connection Default value: VAL_NOT_SET Maximum value: 31536000 precedence This sets the precedence between RULE-based and URL-based policies on the content switching virtual server. The default precedence is RULE. With the precedence set to RULE, incoming requests are evaluated against the content switching policies created with the -rule argument (using the add cs policy CLI command). If none of the rules match, the URL in the request is evaluated
against the content switching policies created with the -url argument (using the add cs policy CLI command). Possible values: RULE, URL Default value: CS_PRIORITY_RULE caseSensitive The URL lookup case option on the content switching vserver. If the case sensitivity of a content switching virtual server is set to 'ON', the URLs /a/1.html and /A/1.HTML are treated differently, and can be switched to different targets with appropriate content switching policies. If the case sensitivity is set to 'OFF', the URLs /a/1.html and /A/1.HTML are treated the same, and are switched to the same target. Possible values: ON, OFF Default value: ON soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut soThreshold If the spillover method is set to CONNECTION or DYNAMICCONNECTION, this value is treated as the maximum number of connections a lb vserver will handle before spillover takes place. If the spillover method is set to BANDWIDTH, this value is treated as the amount of incoming and outgoing traffic (in Kbps) a vserver will handle before spillover takes place. Minimum value: 1 Maximum value: 4294967287 redirectPortRewrite Enable port rewrite while performing HTTP redirect. Possible values: ENABLED, DISABLED Default value: DISABLED downStateFlush Perform delayed cleanup of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED backupVServer The backup virtual server for content switching. disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED insertVserverIPPort The virtual IP and port header insertion option for the vserver. VIPADDR - Header contains the vserver's IP address and port number without any translation. OFF - The virtual IP and port header insertion option is disabled. V6TOV4MAPPING - Header contains the mapped IPv4 address corresponding to the IPv6 address of the vserver and the port number. An IPv6 address can be mapped to a user-specified IPv4 address using the set ns ip6 command. Possible values: OFF, VIPADDR, V6TOV4MAPPING rtspNat Use this parameter to enable natting for RTSP data connection. Possible values: ON, OFF Default value: OFF AuthenticationHost FQDN of authentication vserver Authentication
This option toggles on or off the application of authentication of incoming users to the vserver. Possible values: ON, OFF Default value: OFF Listenpolicy Use this parameter to specify the listen policy for CS Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of CS Vserver. Default value: 101 Maximum value: 100 authn401 This option toggles on or off the HTTP 401 response based authentication. Possible values: ON, OFF Default value: OFF authnVsName Name of authentication vserver push Process traffic on bound Push vserver. Possible values: ENABLED, DISABLED Default value: DISABLED pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. Default value: "none" pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. Possible values: YES, NO Default value: NO tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. mssqlServerVersion The version of the MSSQL server Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_2008B l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF mysqlProtocolVersion The protocol version returned by the mysql vserver. Default value: 10 mysqlServerVersion The server version string returned by the mysql vserver. Default value: NSA_MYSQL_SERVER_VER_DEFAULT mysqlCharacterSet The character set returned by the mysql vserver. Default value: 8
mysqlServerCapabilities The server capabilities returned by the mysql vserver. Default value: 41613 appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example 1. You can use precedence when certain client attributes (e.g., browser type) require to be served with different content. All other clients can then be served from content distributed among the servers. If the precedence is configured as URL, the incoming request URL is evaluated against the content switching policies created with the -url argument. If none of the policies match, the request is applied against the content any switching policies created with the -rule argument. 2. Precedence can also be used when certain content (such as images) is the same for all clients, but other content (such as text) is different for different clients. In this case, the images will be served to all clients, but the text will be served to specific clients based on attributes such as Accept-Language. Related Commands rm cs vserver set cs vserver unset cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver rename cs vserver
rm cs vserver
Synopsis rm cs vserver <name>@ ... Description Remove a virtual server. Arguments name The name of the virtual server to be removed. Example rm vserver cs_vip Related Commands add cs vserver
set cs vserver unset cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver rename cs vserver
set cs vserver
Synopsis set cs vserver <name> [-IPAddress <ip_addr|ipv6_addr|*>] [-IPPattern <ippat>] [-IPMask <ipmask>] [-stateupdate ( ENABLED | DISABLED )] [-precedence ( RULE | URL )] [-caseSensitive ( ON | OFF )] [-backupVServer <string>] [-redirectURL <URL>] [-cacheable ( YES | NO )] [-cltTimeout <secs>] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-redirectPortRewrite ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-insertVserverIPPort <insertVserverIPPort> [<vipHeader>] ] [-rtspNat ( ON | OFF )] [-AuthenticationHost <string>] [-Authentication ( ON | OFF )] [Listenpolicy <expression>] [-Listenpriority <positive_integer>] [-authn401 ( ON | OFF )] [-authnVsName <string>] [-push ( ENABLED | DISABLED )] [-pushVserver <string>] [-pushLabel <expression>] [-pushMultiClients ( YES | NO )] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-l2Conn ( ON | OFF )] [mssqlServerVersion <mssqlServerVersion>] [-mysqlProtocolVersion <positive_integer>] [-mysqlServerVersion <string>] [-mysqlCharacterSet <positive_integer>] [-mysqlServerCapabilities <positive_integer>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] [-icmpVsrResponse ( PASSIVE | ACTIVE )] Description Change the parameters of a content switching virtual server. Arguments name Identifies the virtual server name (created with the add cs vserver command). IPAddress The new IP address of the virtual server. IPPattern The IP Pattern of the virtual server. IPMask The IP Mask of the virtual server IP Pattern stateupdate To enable the state update for a CSW vserver Possible values: ENABLED, DISABLED Default value: ENABLED precedence The precedence on the content switching virtual server between rule-based and URL-based policies. The default precedence is set to RULE. If the precedence is configured as RULE, the incoming request is applied against the content switching policies created with the -rule argument. If none of the rules match, then the URL in the request is applied against the content switching policies created with the -url option. For example, this precedence can be used if certain client attributes (such as a specific type of browser) need to be served different content and all other clients can be served from the content distributed among the servers. If the precedence is configured as URL, the incoming request URL is applied against the content switching policies created with the -url option. If none of the policies match, then the request is applied against the content switching policies created with
the -rule option. Also, this precedence can be used if some content (such as images) is the same for all clients, but other content (such as text) is different for different clients. In this case, the images will be served to all clients, but the text will be served to specific clients based on specific attributes, such as Accept-Language. Possible values: RULE, URL Default value: CS_PRIORITY_RULE caseSensitive The URL lookup case option on the content switching vserver. If case sensitivity of a content switching virtual server is set to 'ON', the URLs /a/1.html and /A/1.HTML are treated differently and may have different targets (set by content switching policies). If case sensitivity is set to 'OFF', the URLs /a/1.html and /A/1.HTML are treated the same, and will be switched to the same target. Possible values: ON, OFF Default value: ON backupVServer The backup virtual server for content switching. redirectURL The redirect URL for content switching. cacheable The option to specify whether a virtual server used for content switching will route requests to the cache redirection virtual server before sending it to the configured servers. Possible values: YES, NO Default value: NO cltTimeout Client timeout in seconds. Default value: VAL_NOT_SET Maximum value: 31536000 soMethod The spillover factor. When traffic on the main virtual server reaches this threshold, additional traffic is sent to the backupvserver. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The spillover persistency entry timeout. Default value: 2 Minimum value: 2 Maximum value: 1440 soThreshold If the spillover method is set to CONNECTION or DYNAMICCONNECTION, this value is treated as the maximum number of connections a lb vserver will handle before spillover takes place. If the spillover method is set to BANDWIDTH, this value is treated as the amount of incoming and outgoing traffic (in Kbps) a vserver will handle before spillover takes place. Minimum value: 1 Maximum value: 4294967294 redirectPortRewrite SSL redirect port rewrite. Possible values: ENABLED, DISABLED Default value: DISABLED downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED insertVserverIPPort The virtual IP and port header insertion option for the vserver. VIPADDR - Header contains the vserver's IP address and port number without any translation. OFF - The virtual IP and port header insertion option is disabled. V6TOV4MAPPING - Header contains the mapped IPv4 address that
corresponds to the IPv6 address of the vserver and the port number. An IPv6 address can be mapped to a user-specified IPv4 address using the set ns ip6 command. Possible values: OFF, VIPADDR, V6TOV4MAPPING rtspNat Use this parameter to enable natting for RTSP data connection. Possible values: ON, OFF Default value: OFF AuthenticationHost FQDN of authentication vserver Authentication This option toggles on or off the application of authentication of incoming users to the vserver. Possible values: ON, OFF Default value: OFF Listenpolicy Use this parameter to specify the listen policy for CS Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of CS Vserver. Default value: 101 Maximum value: 100 authn401 This option toggles on or off the HTTP 401 response based authentication. Possible values: ON, OFF Default value: OFF authnVsName Name of authentication vserver push Process traffic on bound Push vserver. Possible values: ENABLED, DISABLED Default value: DISABLED pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. Default value: "none" pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. Possible values: YES, NO Default value: NO tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF mssqlServerVersion
The version of the MSSQL server Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_2008B mysqlProtocolVersion The protocol version returned by the mysql vserver. Default value: 10 mysqlServerVersion The server version string returned by the mysql vserver. Default value: NSA_MYSQL_SERVER_VER_DEFAULT mysqlCharacterSet The character set returned by the mysql vserver. Default value: 8 mysqlServerCapabilities The server capabilities returned by the mysql vserver. Default value: 41613 appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example
Related Commands add cs policy show cs policy add cs vserver rm cs vserver unset cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver rename cs vserver
unset cs vserver
Synopsis unset cs vserver <name> [-caseSensitive] [-backupVServer] [-cltTimeout] [-redirectURL] [-AuthenticationHost] [-authnVsName] [-pushVserver] [-pushLabel] [-tcpProfileName] [-httpProfileName] [-l2Conn] [mysqlProtocolVersion] [-mysqlServerVersion] [-mysqlCharacterSet] [-mysqlServerCapabilities] [-appflowLog] [-netProfile] [-icmpVsrResponse] [-stateupdate] [-precedence] [-cacheable] [-soMethod] [-soPersistence] [soPersistenceTimeOut] [-redirectPortRewrite] [-downStateFlush] [-disablePrimaryOnDown] [-insertVserverIPPort] [-vipHeader] [-rtspNat] [-Authentication] [-Listenpolicy] [-Listenpriority] [-authn401] [-push] [-pushMultiClients] [comment] [-mssqlServerVersion]
Description Unset the parameters of a content switching virtual server..Refer to the set cs vserver command for meanings of the arguments. Arguments Example Related Commands add cs policy show cs policy add cs vserver set cs vserver rm cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver rename cs vserver
bind cs vserver
Synopsis bind cs vserver <name> [<targetVserver>] [-policyName <string> [-priority <positive_integer>] [gotoPriorityExpression <expression>] [-type ( REQUEST | RESPONSE )] [-invoke (<labelType> <labelName>) ] ] Description Bind a content switching policy between a content-based virtual server and an address-based virtual server. You can assign multiple policies to the virtual server pair. Do not specify the optional policyName when adding a default policy on the content switching virtual server. When binding policies to the content-based virtual server, GotoPriorityExpression applies only to content switching policies with advance policy expression in the rule part. It also applies to application firewall, tranformation, rewrite and responder policies. Flowtype and invoke apply only to rewrite and responder policies. Arguments name The virtual server name (created with the add cs vserver or add cr vserver command) for which the content switching policy will be set. targetVserver The virtual server name (created with the add lb vserver command) to which content will be switched. Example i) bind cs vserver csw-vip1 -policyname csw-policy1 -priority 13 ii) bind cs vserver cswvip2 -policyname csw-ape-policy2 -priority 14 -gotoPriorityExpression NEXT iii) bind cs vserver csw-vip3 -policyname rewrite-policy1 -priority 17 -gotoPriorityExpression 'HTTP.REQ.HEADER("a").COUNT' -flowtype REQUEST -invoke policylabel label1 Related Commands add cs policy
show cs policy unbind cs vserver
unbind cs vserver
Synopsis unbind cs vserver <name> [-policyName <string> [-type ( REQUEST | RESPONSE )]] [-priority <positive_integer>] Description Remove all content switching policies for the specified content switching virtual server. To remove the default policy, do not specify the optional policy name. Arguments name The virtual server name (created with the add cs vserver or add cr vserver command) for which the content switching policy will be set. policyName The content switch policy name (created with the add cs policy command). priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example Related Commands bind cs vserver
enable cs vserver
Synopsis enable cs vserver <name>@ Description Enable a virtual cs server. Note: Virtual servers, when added, are enabled by default. Arguments name The name of the virtual server to be enabled. Example enable vserver cs_vip Related Commands add cs vserver rm cs vserver set cs vserver unset cs vserver disable cs vserver show cs vserver stat cs vserver
rename cs vserver
disable cs vserver
Synopsis disable cs vserver <name>@ Description Disable (makes out of service) a virtual cs server. Arguments name The name of the virtual server to be disabled. Example disable vserver cs_vip Related Commands add cs vserver rm cs vserver set cs vserver unset cs vserver enable cs vserver show cs vserver stat cs vserver rename cs vserver
show cs vserver
Synopsis show cs vserver [<name>] show cs vserver stats - alias for 'stat cs vserver' Description Display the list of content switching virtual servers configured in the system. To show the information for a particular virtual server and the content policies bound to that virtual server, enter the name of the content switching virtual server. Arguments name The name of the content switching virtual server. summary fullValues format level insertVserverIPPort The virtual IP and port header insertion option for the vserver. vipHeader The name of virtual IP and port header.
IPAddress The IP address of the virtual server. IPAddress The IP address of the virtual server. IPPattern The IP address of the virtual server. IPMask The IP address mask of the virtual server. stateflag value The ssl card status for the transparent ssl cs vserver. port A port number for the virtual server. range An IP address range. serviceType The service type of the virtual server. type Virtual server type. state The state of the cs vserver. sc The state of SureConnect the specified virtual server. stateupdate To enable the state update for a CSW vserver status Status. cacheType Cache type. redirect Redirect URL string. precedence This sets the precedence between RULE-based and URL-based policies on the content switching virtual server. The default precedence is RULE. With the precedence set to RULE, incoming requests are evaluated against the content switching policies created with the -rule argument (using the add cs policy CLI command). If none of the rules match, the URL in the request is evaluated against the content switching policies created with the -url argument (using the add cs policy CLI command). redirectURL The redirect URL for content switching. Authentication Authentication. authn401
HTTP 401 response based authentication. authnVsName Name of authentication vserver caseSensitive The URL lookup case option on the content switching vserver. If the case sensitivity of a content switching virtual server is set to 'ON', the URLs /a/1.html and /A/1.HTML are treated differently, and can be switched to different targets with appropriate content switching policies. If the case sensitivity is set to 'OFF', the URLs /a/1.html and /A/1.HTML are treated the same, and are switched to the same target. homePage Home page. dnsVserverName DNS vserver name. domain Domain. rule Rule. policyName Policies bound to this vserver. hits Number of hits. serviceName Service name. weight Weight for this service. cacheVserver Cache vserver name. targetVserver target vserver name. backupVServer The backup virtual server for content switching. priority Priority for the policy. cltTimeout The timeout value in seconds for idle client connection Listenpolicy The string is listenpolicy configured for lb vserver Listenpriority This parameter is the priority for listen policy of LB Vserver. soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. soPersistence
The state of the spillover persistence. soPersistenceTimeOut soThreshold If the spillover method is set to CONNECTION or DYNAMICCONNECTION, this value is treated as the maximum number of connections a lb vserver will handle before spillover takes place. If the spillover method is set to BANDWIDTH, this value is treated as the amount of incoming and outgoing traffic (in Kbps) a vserver will handle before spillover takes place. cacheable The state of caching. url URL string. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. redirectPortRewrite Redirect port rewrite. downStateFlush Perform delayed clean up of connections on this vserver. disablePrimaryOnDown Tells whether traffic will continue reaching backup vservers even after primary comes UP from DOWN state. type The bindpoint to which the policy is bound invoke Invoke flag. labelType The invocation type. labelName Name of the label invoked. gt2GB This argument has no effect. stateChangeTimeSec Time when last state change happened. Seconds part. stateChangeTimemSec Time at which last state change happened. Milliseconds part. ticksSinceLastStateChange Time in 10 millisecond ticks since the last state change. rtspNat Use this parameter to enable natting for RTSP data connection. AuthenticationHost FQDN of authentication vserver push Process traffic on bound Push vserver.
pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. appfwPolicyFlag flags policySubType mssqlServerVersion The version of the MSSQL server l2Conn Use L2 Parameters to identify a connection mysqlProtocolVersion The protocol version returned by the mysql vserver. mysqlServerVersion The server version string returned by the mysql vserver. mysqlCharacterSet The character set returned by the mysql vserver. mysqlServerCapabilities The server capabilities returned by the mysql vserver. appflowLog Enable logging appflow flow information netProfile The name of the network profile. icmpVsrResponse Can be active or passive count Example Related Commands add cs vserver
rm cs vserver set cs vserver unset cs vserver enable cs vserver disable cs vserver stat cs vserver rename cs vserver
stat cs vserver
Synopsis stat cs vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display content switch vserver statistics. Arguments name The name of the vserver for which statistics will be displayed. If not given statistics are shown for all cs vservers. count devno stateflag Current Client Est connections (ClntEstConn) Number of client connections in ESTABLISHED state. IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Vserver hits (Hits) Total vserver hits Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb)
Number of response bytes received by this service or virtual server. Total Packets rcvd (PktRx) Total number of packets received by this service or virtual server. Total Packets sent (PktTx) Total number of packets sent. Current client connections (ClntConn) Number of current client connections. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Spill Over Threshold (SOThresh) Spill Over Threshold set on the VServer. Spill Over Hits (NumSo ) Number of times vserver expereinced spill over. Labeled Connection (LblConn) Number of Labeled connection on this vserver Push Labeled Connection (PushLbl) Number of labels for this push vserver. Deferred Request (DefReq) Number of deferred request on this vserver Invalid Request/Response (IvldReqRsp) Number invalid requests/responses on this vserver Invalid Request/Response Dropped (IvldReqRspDrp) Number invalid requests/responses dropped on this vserver Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state. Example
Related Commands add cs vserver rm cs vserver set cs vserver unset cs vserver enable cs vserver disable cs vserver show cs vserver rename cs vserver
rename cs vserver
Synopsis rename cs vserver <name>@ <newName>@
Description Rename a content virtual server. Arguments name The name of the content switching virtual server. newName The new name of the virtual server. Example rename cs vserver cs1 cs2
Related Commands add cs vserver rm cs vserver set cs vserver unset cs vserver enable cs vserver disable cs vserver show cs vserver stat cs vserver
Chapter
17
DNS Commands
Topics: stat dns add dns aaaaRec rm dns aaaaRec show dns aaaaRec add dns addRec rm dns addRec show dns addRec add dns txtRec rm dns txtRec show dns txtRec add dns cnameRec rm dns cnameRec show dns cnameRec add dns mxRec rm dns mxRec set dns mxRec unset dns mxRec show dns mxRec add dns nsRec rm dns nsRec show dns nsRec add dns ptrRec rm dns ptrRec show dns ptrRec add dns srvRec rm dns srvRec set dns srvRec unset dns srvRec show dns srvRec add dns soaRec rm dns soaRec set dns soaRec unset dns soaRec show dns soaRec add dns suffix rm dns suffix
474 | Citrix NetScaler 10 | DNS Commands
show dns suffix add dns nameServer rm dns nameServer enable dns nameServer disable dns nameServer show dns nameServer add dns view rm dns view show dns view add dns policy rm dns policy set dns policy show dns policy add dns zone set dns zone unset dns zone rm dns zone sign dns zone unsign dns zone show dns zone add dns key create dns key set dns key unset dns key rm dns key show dns key flush dns proxyRecords stat dns records show dns stats set dns parameter unset dns parameter show dns parameter add dns policylabel rm dns policylabel bind dns policylabel unbind dns policylabel show dns policylabel stat dns policylabel rename dns policylabel bind dns global unbind dns global show dns global add dns action rm dns action set dns action unset dns action show dns action show dns nsecRec
Citrix NetScaler 10 | DNS Commands | 475
stat dns
Synopsis stat dns [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display DNS statistics. Arguments Dns queries (Q) Total number of DNS queries received. Multi queries (MtQ) Total number of Multi Query request received. Dns responses (Rsp) Total number of DNS responses received. Server responses (SvrRsp) Total number of Server responses received. Total Record updates (TotRecUp) Total number of record updates. Auth answers (AuthAns) Number of queries which were authoritatively answered. Server queries (SvrQ) Total number of Server queries sent. Cache flush called (CaFsh) Total number of times cache was flushed. Cache entries flushed (CaEntFsh) Total number of cache entries flushed. Non-authoritative entries (PxyEnt) Total number of non-authoritative entries. Authoritative entries (AthEnt) Total number of authoritative entries. Nonexistent domain (NoDomain) Number of queries for which no record was found. Response class unsupported (RspClsEr) Total number of responses for which response types were unsupported. Invalid query format (InQFmt) Total number of queries whose format was invalid. Stray answers (StryRsp) Total number of stray answers. Incorrect RD length (BadRDlen) Number of DNS responses received with invalid resoure data length. Requests refused (ReqRefused) Number of DNS requests refused. Response type unsupported (RspNoSup)
Total number of responses for which response type requested was unsupported. Query class unsupported (QClsEr) Total number of queries for which query class was unsupported. Invalid response format (InRspFmt) Total number of responses for which there was a format error. No answer responses (NoAnswer) Number of DNS responses received without answer. Multi queries disabled (MtQErr) Total number of times a multi query was disabled and received a multi query. Other errors (OtherErr) Total number of other errors. NS queries (NSQ) Total number of NS queries received. SOA queries (SOAQ) Total number of SOA queries received. PTR queries (PTRQ) Total number of PTR queries received. SRV queries (SRVQ) Total number of SRV queries received. A responses (ARsp) Total number of A responses received. CNAME responses (CNRsp) Total number of CNAME responses received. MX responses (MXRsp) Total number of MX responses received. ANY responses (ANYRsp) Total number of ANY responses received. NS updates (NSUp) Total number of NS record updates. SOA updates (SOAUp) Total number of SOA record updates. PTR updates (PTRUp) Total number of PTR record updates. SRV updates (SRVUp) Total number of SRV record updates. AAAA queries (AAAAQ) Total number of AAAA queries received. A queries (AQ) Total number of A queries received. CNAME queries (CNQ) Total number of CNAME queries received. MX queries (MXQ)
Total number of MX queries received. ANY queries (ANYQ) Total number of ANY queries received. AAAA responses (AAAARsp) Total number of AAAA responses received. NS responses (NSRsp) Total number of NS responses received. SOA responses (SOARsp) Total number of SOA responses received. PTR responses (PTRRsp) Total number of PTR responses received. SRV responses (SRVRsp) Total number of SRV responses received. AAAA updates (AAAAUp) Total number of AAAA record updates. A updates (AUp) Total number of A record updates. MX updates (MXUp) Total number of MX record updates. CNAME updates (CNUp) Total number of CNAME record updates. AAAA records (AAAARec) Total number of AAAA records. A records (ARec) Total number of A records. MX records (MXRec) Total number of MX records. CNAME records (CNRec) Total number of CNAME records. NS records (NSRec) Total number of NS records. SOA records (SOARec) Total number of SOA records. PTR records (PTRRec) Total number of PTR records. SRV records (SRVRec) Total number of SRV records. No AAAA records (NoAAAARec) Total number of times AAAA record lookup failed. No A records (NoARec) Total number of times A record lookup failed. No MX records (NoMXRec)
Total number of times MX record lookup failed. No PTR records (NoPTRRec) Total number of times PTR record lookup failed. No NS records (NoNSRec) Total number of times NS record lookup failed. No CNAME records (NoCNRec) Total number of times CNAME record lookup failed. No SOA records (NoSOARec) Total number of times SOA record lookup failed. No SRV records (NoSRVRec) Total number of times SRV record lookup failed. No ANY records (NoANYrec) Total number of times ANY query lookup failed. Unsupported queries (NotSupQ) Total number of requests for which query type requested was unsupported. Example
Related Commands stat dns records stat dns policylabel
add dns aaaaRec

Synopsis add dns aaaaRec <hostName> <IPv6Address> ... [-TTL <secs>] Description Add an AAAA address record for the specified domain name. Arguments hostName The domain name for which the address record is added. IPv6Address Specify one or more IP addresses for the domain name. TTL Specify the time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns aaaarec www.mynw.com 3::4:5 -ttl 10
Related Commands rm dns aaaaRec show dns aaaaRec
rm dns aaaaRec
Synopsis rm dns aaaaRec <hostName> [<IPv6Address> ...] Description This command removes the specified IPv6 address from the address record for the given domain name. If IPv6 address is not specified, the entire address record for the given domain name is removed. Arguments hostName The host name for which the AAAA record is to be removed. IPv6Address Specify one or more IPv6 addresses for the AAAA record to be removed. If all IPv6 records within a domain are removed, the domain name entry is also removed. Example rm dns aaaarec www.mynw.com
Related Commands add dns aaaaRec show dns aaaaRec
show dns aaaaRec

Synopsis show dns aaaaRec [<hostName> | -type <type>] Description Show the IPv6 address0 record for the specified host name. If a host name is not specified, all IPv6 address records are displayed. Arguments hostName The domain name for which the address record is to be displayed. type Specify the address record type. The record type can take 3 values: ADNS - If this is specified, all of the authoritative address records will be displayed. PROXY - If this is specified, all of the proxy address records will be displayed. ALL - If this is specified, all of the address records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level IPv6Address
Specify one or more IP addresses for the domain name. TTL Specify the time to live, in seconds. vServerName Vitual server name. authType Authentication type. count stateflag Example
Related Commands add dns aaaaRec rm dns aaaaRec
add dns addRec

Synopsis add dns addRec <hostName> <IPAddress> ... [-TTL <secs>] Description Add an address record for the specified domain name. Arguments hostName The domain name for which the address record is being added. IPAddress One or more IP addresses for the domain name. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example Add dns addrec www.mynw.com 65.200.211.139 -ttl 10
Related Commands rm dns addRec show dns addRec
rm dns addRec
Synopsis rm dns addRec <hostName> [<IPAddress> ...]
Description Remove the specified ipaddress from the address record for the given domain name. If IP address is not specified, the entire address record for the given domain name is removed. Arguments hostName The host name for which the address record is to be removed. IPAddress One or more IP addresses for the address record to be removed. If all address records within a domain are removed, the domain name entry is also removed. Example rm dns addrec www.mynw.com
Related Commands add dns addRec show dns addRec
show dns addRec

Synopsis show dns addRec [<hostName> | -type <type>] Description Display the address record for the specified host name. If a host name is not specified, all address records are displayed. Arguments hostName The domain name. type The address record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative address records will be displayed. PROXY - If this is specified, all of the proxy address records will be displayed. ALL - If this is specified, all of the address records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level IPAddress IP addresses for the domain name. TTL The time to live, in seconds. vServerName Vitual server name.
authType Authentication type. count stateflag Example
Related Commands add dns addRec rm dns addRec
add dns txtRec

Synopsis add dns txtRec <domain> <string> ... [-TTL <secs>] Description Add an TXT record for the specified domain name. Arguments domain The owner domain name of the TXT record. string The text of the txt record. Maximum of 6 strings are allowed. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns txtRec spf.m.test. "v=spf1 ip4:1.2.3.0/24 ip4:1.3.4.0/24 ?all" add dns txtRec comments.m.test. "This is a CHARSTR" "This is another CHARSTR" Related Commands rm dns txtRec show dns txtRec
rm dns txtRec
Synopsis rm dns txtRec <domain> (<string> ... | -recordId <positive_integer>@) Description Remove the given TXT record for the given domain name. Arguments domain The owner domain name of the TXT record.
string The text of the txt record. Maximum of 6 strings are allowed. recordId The record identifier of the record to be removed. Minimum value: 1 Maximum value: 65535 Example rm dns txtRec spf.m.test. "v=spf1 ip4:1.2.3.0/24 ip4:1.3.4.0/24 ?all" rm dns txtRec comments.m.test. "This is a CHARSTR" "This is another CHARSTR" rm dns txtRec comments.m.test. -recordId 1411
Related Commands add dns txtRec show dns txtRec
show dns txtRec

Synopsis show dns txtRec [<domain> | -type <type>] Description Display the TXT record for the specified domain. If the domain name is not specified, all of the TXT records are displayed. Arguments domain The owner domain name of the TXT record. type The TXT record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative TXT records will be displayed. PROXY - If this is specified, all of the proxy TXT records will be displayed. ALL - If this is specified, all of the TXT records will be displayed. Possible values: ALL, ADNS, PROXY Default value: NSDNS_AUTH_HOST summary fullValues format level string The text of the txt record. Maximum of 6 strings are allowed. TTL Time to live, in seconds. recordId authType Authentication type. count stateflag
Example show dns txtRec spf.m.test. show dns txtRec Related Commands add dns txtRec rm dns txtRec
add dns cnameRec

Synopsis add dns cnameRec <aliasName> <canonicalName> [-TTL <secs>] Description Add a canonical name record. Arguments aliasName Alias name for the specified domain. canonicalName The domain for which cnamerec is created. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns cnameRec www.mynw.org www.mynw.com -ttl 20 Related Commands rm dns cnameRec show dns cnameRec
rm dns cnameRec
Synopsis rm dns cnameRec <aliasName> Description Remove the canonical name record. Arguments aliasName The name of the alias to be removed. Example rm dns cnamerec www.mynw.org Related Commands add dns cnameRec
show dns cnameRec
show dns cnameRec

Synopsis show dns cnameRec [<aliasName> | -type <type>] Description Display the cname records. If no alias name is specified, all "cname" records are displayed. Arguments aliasName The alias name. If an alias name is not specified, all "cname" records are displayed. type The cname record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative cname records will be displayed. PROXY - If this is specified, all of the proxy cname records will be displayed. ALL - If this is specified, all of the cname records will be displayed. Possible values: ALL, ADNS, PROXY Default value: NSDNS_AUTH_HOST summary fullValues format level canonicalName The domain for which cnamerec is created. TTL Time to live, in seconds. vServerName GSLB Vitual server name to which this domain is bound authType Record type. count stateflag Example show dns cnameRec www.mynw.org Related Commands add dns cnameRec rm dns cnameRec
add dns mxRec

Synopsis add dns mxRec <domain> -mx <string> -pref <positive_integer> [-TTL <secs>]
Description Add the DNS mail exchange (MX) record. Arguments domain The domain for which the added MX record is added. mx The MX record name. pref The route priority number. Note: A domain name can have multiple mail routes, with a priority number assigned to each. The mail route with the lowest number identifies the server responsible for the domain. Other mail servers listed are used as backups. Maximum value: 65535 TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands rm dns mxRec set dns mxRec unset dns mxRec show dns mxRec
rm dns mxRec
Synopsis rm dns mxRec <domain> <mx> Description Remove the DNS mail exchange record. Arguments domain The domain for the mail exchange record to be removed. mx The mail exchange record name. Example
Related Commands add dns mxRec set dns mxRec unset dns mxRec show dns mxRec
set dns mxRec

Synopsis set dns mxRec <domain> -mx <string> [-pref <positive_integer>] [-TTL <secs>] Description Set the DNS MX (mail exchange) record parameters. Arguments domain The domain to be associated with the MX record. mx The name of the MX record. pref The priority number of the domain's mail route. Because one domain name can have multiple mail routes, you must specify a priority number for each domain's route. The mail route with the lowest number identifies the server responsible for the domain. Other mail servers listed are used as backups. Maximum value: 65535 TTL The time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands add dns mxRec rm dns mxRec unset dns mxRec show dns mxRec
unset dns mxRec

Synopsis unset dns mxRec <domain> -mx <string> -TTL Description Use this command to remove dns mxRec settings.Refer to the set dns mxRec command for meanings of the arguments. Arguments Example
Related Commands add dns mxRec rm dns mxRec
set dns mxRec show dns mxRec
show dns mxRec

Synopsis show dns mxRec [<domain> | -type <type>] Description Display the mail exchange (MX) record for the specified domain. If a domain name is not specified, all mail exchange records are displayed. Arguments domain The domain name. type The MX record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative MX records will be displayed. PROXY - If this is specified, all of the proxy MX records will be displayed. ALL - If this is specified, all of the MX records will be displayed. Possible values: ALL, ADNS, PROXY Default value: NSDNS_AUTH_HOST summary fullValues format level mx The MX record name. pref The route priority number. Note: A domain name can have multiple mail routes, with a priority number assigned to each. The mail route with the lowest number identifies the server responsible for the domain. Other mail servers listed are used as backups. TTL Time to live, in seconds. authType Record type. count stateflag Example
Related Commands add dns mxRec rm dns mxRec set dns mxRec unset dns mxRec
add dns nsRec

Synopsis add dns nsRec <domain> <nameServer> [-TTL <secs>] Description Add the name server record for a given domain name. Arguments domain The domain name for which a name server record is added. nameServer The nameserver for the domain. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands rm dns nsRec show dns nsRec
rm dns nsRec
Synopsis rm dns nsRec <domain> <nameServer> Description Remove the name server record for a domain. Arguments domain The domain name whose name server record is to be removed. nameServer The name server for the domain to be removed. Example
Related Commands add dns nsRec show dns nsRec
show dns nsRec

Synopsis show dns nsRec [<domain> | -type <type>]
Description Display the name server record for a domain. If no domain name is specified, all of the name server records are displayed. Arguments domain The domain name for the name server record. type The name server record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative name server records will be displayed. PROXY - If this is specified, all of the proxy name server records will be displayed. ALL - If this is specified, all of the name server records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level nameServer The nameserver for the domain. TTL Time to live, in seconds. authType Record type. count stateflag Example
Related Commands add dns nsRec rm dns nsRec
add dns ptrRec

Synopsis add dns ptrRec <reverseDomain> <domain> ... [-TTL <secs>] Description Add a PTR record for the specified reverse domain name. Arguments reverseDomain Reverse domain name with suffixes, e.g.: in-addr.arpa. or ip6.arpa.. domain The domain name for which reverse mapping is being done.
TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns ptrrec 1.1.1.in-addr.arpa. abc.com Related Commands rm dns ptrRec show dns ptrRec
rm dns ptrRec
Synopsis rm dns ptrRec <reverseDomain> [<domain> ...] Description Remove a PTR record corresponding to a given reverse domain name and domain name. Arguments reverseDomain The reverse domain name of the PTR record being removed. domain The domain name whose reverse mapping is being removed. Example rm dns ptrrec 1.1.1.1.in-addr.arpa. ptr.com Related Commands add dns ptrRec show dns ptrRec
show dns ptrRec

Synopsis show dns ptrRec [<reverseDomain> | -type <type>] Description Display the PTR record for the specified reverse domain name and domain name. Arguments reverseDomain The reverse domain name of the PTR record being displayed. type PTR record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative ptr records will be displayed. PROXY - If this is specified, all of the proxy ptr records will be displayed. ALL - If this is specified, all of the ptr records will be displayed. Possible values: ALL, ADNS, PROXY
summary fullValues format level domain The domain name for which reverse mapping is being done. TTL Time to live, in seconds. authType Authentication type. count stateflag Example
Related Commands add dns ptrRec rm dns ptrRec
add dns srvRec

Synopsis add dns srvRec <domain> <target> -priority <positive_integer> -weight <positive_integer> -port <positive_integer> [-TTL <secs>] Description Add an SRV record for the specified domain name. Arguments domain The domain name that is offering the services. The domain name includes the service offered and transport layer protocol, e.g.: _ftp._tcp.abc.com. target The target host that is hosting the specified service. priority The target host priority. This helps in server selection by the client. Maximum value: 65535 weight Weight for the target host. This helps in server selection by the client in case of same priority Maximum value: 65535 port Port on which the target host is listening for client requests. Maximum value: 65535 TTL The time to live, measured in seconds. Default value: 3600 Maximum value: 2147483647
Example
Related Commands rm dns srvRec set dns srvRec unset dns srvRec show dns srvRec
rm dns srvRec
Synopsis rm dns srvRec <domain> <target> ... Description Remove the SRV record for a given domain name and target. Arguments domain The domain name of the SRV record to be removed. target The target host that is hosting the service to be removed. Example
Related Commands add dns srvRec set dns srvRec unset dns srvRec show dns srvRec
set dns srvRec

Synopsis set dns srvRec <domain> <target> [-priority <positive_integer>] [-weight <positive_integer>] [-port <positive_integer>] [-TTL <secs>] Description Set the SRV record attributes. Arguments domain The domain name for which the service is configured. target The target host that is hosting the service whose attributes are to be changed
priority Priority of the target host. This helps in server selection by the client. Maximum value: 65535 weight Weight for the target host. This helps in server selection by the client in case of same priority Maximum value: 65535 port Port on which the target host is listening for client requests. Maximum value: 65535 TTL The time to live, measured in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands add dns srvRec rm dns srvRec unset dns srvRec show dns srvRec
unset dns srvRec

Synopsis unset dns srvRec <domain> <target> -TTL Description Use this command to remove dns srvRec settings.Refer to the set dns srvRec command for meanings of the arguments. Arguments Example
Related Commands add dns srvRec rm dns srvRec set dns srvRec show dns srvRec
show dns srvRec

Synopsis show dns srvRec [(<domain> [<target>]) | -type <type>] Description Display the SRV record for the specified domain. If the domain name is not specified, all of the SRV records are displayed.
Arguments domain The domain name for which the SRV record will be displayed. target The target host that is hosting the service whose attributes are to be displayed type SRV record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative SRV records will be displayed. PROXY - If this is specified, all of the proxy SRV records will be displayed. ALL - If this is specified, all of the SRV records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level priority Priority of the target host. This helps in server selection by the client. weight Weight for the target host. This helps in server selection by the client in case of same priority port Port on which the target host is listening for client requests. TTL The time to live, measured in seconds. authType Record type. count stateflag Example
Related Commands add dns srvRec rm dns srvRec set dns srvRec unset dns srvRec
add dns soaRec

Synopsis add dns soaRec <domain> -originServer <string> -contact <string> [-serial <positive_integer>] [-refresh <secs>] [retry <secs>] [-expire <secs>] [-minimum <secs>] [-TTL <secs>] Description Add the Start of Authority (SOA) record.
Arguments domain The domain name for which the SOA record is added. originServer The name of the origin server for the given domain. contact The contact person for this ADNS. Typically this is an email address for which the at sign (@) has been replaced by a period (.). serial The secondary server uses this parameter to determine if it requires a zone transfer from the primary server. If the secondary server's number is lower than the primary's, the secondary server knows that its records are out of date. This parameter is not used by a primary server. Default value: 100 Maximum value: 4294967294 refresh The number of seconds between a successful serial number check on the primary server's zone, and the next attempt. It is usually 2-24 hours. This value is not used by a primary server. Default value: 3600 Maximum value: 4294967294 retry When a refresh attempt fails, a server will retry after the specified number of seconds. This parameter is not used by a primary server. Default value: 3 Maximum value: 4294967294 expire Measured in seconds. If the refresh and retry attempts fail after the specified number of seconds, the server will stop serving the zone. The typical value is 1 week. This parameter is not used by a primary server. Default value: 3600 Maximum value: 4294967294 minimum The default TTL for every record in the zone. You can override this value for a particular record. Typical values range from eight hours to four days. This value is often set at ten minutes or less when changes are being made to a zone. Default value: 5 Maximum value: 2147483647 TTL The time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands rm dns soaRec set dns soaRec unset dns soaRec show dns soaRec
rm dns soaRec
Synopsis rm dns soaRec <domain> Description Remove the Start of Authority (SOA) record for a given domain name.
Arguments domain The domain name for the SOA record to be removed. Example
Related Commands add dns soaRec set dns soaRec unset dns soaRec show dns soaRec
set dns soaRec

Synopsis set dns soaRec <domain> [-originServer <string>] [-contact <string>] [-serial <positive_integer>] [-refresh <secs>] [-retry <secs>] [-expire <secs>] [-minimum <secs>] [-TTL <secs>] Description Set the DNS Start Of Authority (SOA) record attributes. Arguments domain The domain name for which the SOA record attributes are set. originServer The origin server name for the given domain. contact The contact person for this ADNS. Typically it is the email address, with the at sign (@) replaced by a period (.). serial The secondary server number. This number is used by a secondary server to determine if it requires a zone transfer from the primary server. If the secondary server's number is lower than the primary's, the secondary server determines that its records are out of date. This parameter is not used by a primary server. Default value: 100 Minimum value: 1 Maximum value: 4294967294 refresh The refresh time in seconds. Refresh determines the number of seconds between a successful check on the serial number on the zone of the primary, and the next attempt (usually 2-24 hours). This parameter is used by a primary server. Default value: 3600 Maximum value: 4294967294 retry The retry time in seconds. If a refresh attempt fails, a server will retry after the specified number of seconds. Not used by a primary server. Default value: 3 Maximum value: 4294967294 expire The expire time in seconds. If the refresh and retry attempts fail after the specified number of seconds, the server will stop serving the zone. The typical value is 1 week. Not used by a primary server. Default value: 3600 Maximum value: 4294967294 minimum
The default TTL for every record in the zone. You can override this value for a specific record. Typical values range from eight hours to four days. This value is often set to 10 minutes or less when changes are being made to a zone. Default value: 5 Maximum value: 2147483647 TTL The time to live, measured in seconds. Default value: 3600 Maximum value: 2147483647 Example
Related Commands add dns soaRec rm dns soaRec unset dns soaRec show dns soaRec
unset dns soaRec

Synopsis unset dns soaRec <domain> [-serial] [-refresh] [-retry] [-expire] [-minimum] [-TTL] Description Use this command to remove dns soaRec settings.Refer to the set dns soaRec command for meanings of the arguments. Arguments Example
Related Commands add dns soaRec rm dns soaRec set dns soaRec show dns soaRec
show dns soaRec

Synopsis show dns soaRec [<domain> | -type <type>] Description Display the specified Start of Authority record. If the domain name is not specified, all of the SOA records are displayed. Arguments domain The domain name. type
The SOA record type. The type can take 3 values : ADNS - If this is specified, all of the authoritative SOA records will be displayed. PROXY - If this is specified, all the proxy SOA records will be displayed. ALL - If this is specified, all the SOA records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level originServer The name of the origin server for the given domain. contact The contact person for this ADNS. Typically this is an email address for which the at sign (@) has been replaced by a period (.). serial The secondary server uses this parameter to determine if it requires a zone transfer from the primary server. If the secondary server's number is lower than the primary's, the secondary server knows that its records are out of date. This parameter is not used by a primary server. refresh The number of seconds between a successful serial number check on the primary server's zone, and the next attempt. It is usually 2-24 hours. This value is not used by a primary server. retry When a refresh attempt fails, a server will retry after the specified number of seconds. This parameter is not used by a primary server. expire Measured in seconds. If the refresh and retry attempts fail after the specified number of seconds, the server will stop serving the zone. The typical value is 1 week. This parameter is not used by a primary server. minimum The default TTL for every record in the zone. You can override this value for a particular record. Typical values range from eight hours to four days. This value is often set at ten minutes or less when changes are being made to a zone. TTL The time to live, in seconds. authType Record type. count stateflag Example
Related Commands add dns soaRec rm dns soaRec set dns soaRec
unset dns soaRec
add dns suffix

Synopsis add dns suffix <dnsSuffix> Description Append suffixes while resolving the domain names. Arguments dnsSuffix Suffix to be appended while resolving the domain name. Example add dns suffix netscaler.com If the incoming domain name "engineering" is not resolved by itself, the system will append the suffix netscaler.com and attempt to resolve the name engineering.netscaler.com. Related Commands rm dns suffix show dns suffix
rm dns suffix
Synopsis rm dns suffix <dnsSuffix> Description Remove the DNS suffixes. Arguments dnsSuffix Suffix name to be removed. Example
Related Commands add dns suffix show dns suffix
show dns suffix

Synopsis show dns suffix [<dnsSuffix>] Description Display all the configured DNS suffixes.
Arguments dnsSuffix Suffix to be appended while resolving the domain name. summary fullValues format level count stateflag Example
Related Commands add dns suffix rm dns suffix
add dns nameServer

Synopsis add dns nameServer ((<IP> [-local]) | <dnsVserverName>) [-state ( ENABLED | DISABLED )] [-type <type>] Description Add a name server. Two types of name servers can be added: 1. IP Address-based name server. In this case, the user must specify the Ipaddress of the name server to be contacted. 2. Vserver-based name server. In this case, the user must specify the name of the DNS vserver configured in the System. Arguments IP The IP address of the name server. dnsVserverName The name of the dns vserver local IP is a local recursive nameserver. state The administrative state of the nameserver. Possible values: ENABLED, DISABLED Default value: ENABLED type The protocol type of the name server. While adding a vserver-based name server UDP_TCP is not a valid type. Possible values: UDP, TCP, UDP_TCP Default value: NSA_UDP Example Adding an-IP based nameserver IP: add nameserver 10.102.4.1, Adding a vserver-based name server: add nameserver dns_vsvr where dns_vsvr is the name of a DNS vserver created in the system.
Related Commands rm dns nameServer enable dns nameServer disable dns nameServer show dns nameServer
rm dns nameServer
Synopsis rm dns nameServer (<IP> | <dnsVserverName>) Description Remove the NameServer. Arguments IP The IP address of the name server. dnsVserverName The name of the dns vserver. Example Deleting an IP-based nameserver: rm nameserver 10.102.4.1, Deleting a vserver-based nameserver: rm nameserver dns_vsvr Related Commands add dns nameServer enable dns nameServer disable dns nameServer show dns nameServer
enable dns nameServer

Synopsis enable dns nameServer (<IP> | <dnsVserverName>) Description Enable a nameserver. Arguments IP The IP address of the name server. dnsVserverName The name of the dns vserver. Example enable dns nameserver 10.14.43.149
Related Commands add dns nameServer rm dns nameServer disable dns nameServer show dns nameServer
disable dns nameServer

Synopsis disable dns nameServer (<IP> | <dnsVserverName>) Description Disable a nameserver. Arguments IP The IP address of the name server. dnsVserverName The name of the dns vserver Example disable dns nameserver 10.14.43.149 Related Commands add dns nameServer rm dns nameServer enable dns nameServer show dns nameServer
show dns nameServer

Synopsis show dns nameServer [<IP> | <dnsVserverName>] Description Display the name servers configured in the system and the state of the name servers. Arguments IP The IP address of the name server. dnsVserverName The name of the dns vserver. summary fullValues format
level serviceName The name of the dns vserver. port Port of the service. type The protocol type of the name server. While adding a vserver-based name server UDP_TCP is not a valid type. state State of the server. local ip is a local recursive nameserver. adminState ClMonOwner Tells the mon owner of the service. ClMonView Tells the view id by which state of the service is updated. count stateflag Example
Related Commands add dns nameServer rm dns nameServer enable dns nameServer disable dns nameServer
add dns view

Synopsis add dns view <viewName> Description Adds a dns view, used for dns view-based policies and for binding a view-specific IP for a gslb service. Arguments viewName Name of the view name. Example add dns view privateview
Related Commands rm dns view show dns view
rm dns view
Synopsis rm dns view <viewName> Description Removes a dns view that is used for dns view-based policies, and for binding a view-specific IP for a gslb service. Arguments viewName Name of the view name. Example rm dns view privateview Related Commands add dns view show dns view
show dns view

Synopsis show dns view [<viewName>] Description Displays the dns views configured in the system. Arguments viewName The name of the view to be displayed. summary fullValues format level serviceName Service name of the service using this view. gslbServiceName Service name of the service using this view. dnsPolicyName dnspolicy name of this view. IPAddress IP of the service corresponding to the given view.
flags Flags controlling display. stateflag flags controlling display count Example
Related Commands add dns view rm dns view
add dns policy

Synopsis add dns policy <name> <rule> <actionName> Description Add a dns policy. DNS policies that can be added are Interface, IP,VLAN expressions. Arguments name Name of the dns policy. rule Expression to be used by the dns policy. viewName The view name that must be used for the given policy. preferredLocation The location used for the given policy. This is deprecated attribute. Please use -prefLocList preferredLocList The location list in priority order used for the given policy. drop The dns packet must be dropped. Possible values: YES, NO cacheBypass By pass dns cache for this. Possible values: YES, NO actionName Name of the dns action added using add dns action command. Example add dns policy pol1 "dns.req.question.type.ne(aaaa)" -actionName act1 add dns policy pol2 "CLIENT.IP.SRC.IN_SUBNET(1.1.1.1/24)" -actionName action1 add dns policy pol1 dns.res.question.domain.contains("citrix") -actionName act2 Related Commands rm dns policy
set dns policy show dns policy
rm dns policy
Synopsis rm dns policy <name> Description Removes a dns policy. Arguments name Name of the dns policy. Example
Related Commands add dns policy set dns policy show dns policy
set dns policy

Synopsis set dns policy <name> [<rule>] [-actionName <string>] Description Used to change the expression or action of an already existing policy. DNS policies that can be set are Interface,IP,VLAN expressions. Arguments name Name of the dns policy. rule Expression to be used by dns policy. viewName The view name that must be used for the given policy preferredLocation The location used for the given policy. This is deprecated attribute. Please use -prefLocList preferredLocList The location list in priority order used for the given policy. drop The dns packet must be dropped. Possible values: YES, NO cacheBypass By pass dns cache for this. Possible values: YES, NO
actionName Name of the dns action added using add dns action command. Example set dns policy pol1 -rule "dns.req.question.type.ne(aaaa)" set dns policy pol2 -rule "CLIENT.IP.SRC.IN_SUBNET(1.1.1.1/24)" set dns policy pol1 -rule dns.res.header.rcode.eq(nxdomain) Related Commands add dns policy rm dns policy show dns policy
show dns policy

Synopsis show dns policy [<name>] Description Used to display the policy-related information. Arguments name Name of the dns policy. summary fullValues format level rule The expression to be used by the dns policy. viewName The view name that must be used for the given policy preferredLocation The location used for the given policy. This is deprecated attribute. Please use -prefLocList preferredLocList The location list in priority order used for the given policy. hits The number of times the policy has been hit. undefHits Number of Undef hits. drop The dns packet must be dropped. actionName Name of the dns action added using add dns action command.
cacheBypass By pass dns cache for this. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policy count stateflag Example
Related Commands add dns policy rm dns policy set dns policy
add dns zone

Synopsis add dns zone <zoneName> -proxyMode ( YES | NO ) Description Add a DNS zone on NetScaler Arguments zoneName The name of the zone being added. proxyMode zone deployed in proxy mode. Possible values: YES, NO Default value: ENABLED Example add dns zone foo.bar -proxyMode NO -dnssec ENABLED
Related Commands set dns zone unset dns zone rm dns zone sign dns zone unsign dns zone show dns zone
set dns zone

Synopsis set dns zone <zoneName> [-proxyMode ( YES | NO )] Description set a DNS zone parameters on NetScaler Arguments zoneName The name of the zone being added. proxyMode zone deployed in proxy mode. Possible values: YES, NO Default value: ENABLED Example set dns zone foo.bar -proxyMode NO -dnssec ENABLED Related Commands add dns zone unset dns zone rm dns zone sign dns zone unsign dns zone show dns zone
unset dns zone

Synopsis unset dns zone <zoneName> -proxyMode Description Use this command to remove dns zone settings.Refer to the set dns zone command for meanings of the arguments. Arguments Example
Related Commands add dns zone set dns zone rm dns zone sign dns zone unsign dns zone show dns zone
rm dns zone
Synopsis rm dns zone <zoneName> Description Remove the ZONE record for a given zone name. Arguments zoneName The name of the zone to be removed. Example
Related Commands add dns zone set dns zone unset dns zone sign dns zone unsign dns zone show dns zone
sign dns zone

Synopsis sign dns zone <zoneName> [-keyName <string> ...] Description sign a dns zone with the given key Arguments zoneName The name of the zone being signed. keyName The name given to a public/private key pair.
Example sign dns zone abc.com. -keyname abc.com.zsk abc.com.ksk Related Commands add dns zone set dns zone unset dns zone rm dns zone unsign dns zone show dns zone
unsign dns zone

Synopsis unsign dns zone <zoneName> [-keyName <string> ...] Description Unsign a zone with the specified key Arguments zoneName The name of the zone being signed. keyName The name given to a public/private key pair. Example unsign dns zone abc.com. -keyname abc.com.zsk abc.com.ksk Related Commands add dns zone set dns zone unset dns zone rm dns zone sign dns zone show dns zone
show dns zone

Synopsis show dns zone [<zoneName> | -type <type>] Description Show a DNS zone on NetScaler Arguments zoneName
The name of the zone whose info is to be displayed. type Zone type. The type can take 3 values: ADNS - If this is specified, all of the authoritative zones will be displayed. PROXY - If this is specified, all of the proxy zones will be displayed. ALL - If this is specified, all of the zones will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues format level proxyMode zone deployed in proxy mode. flags Flags controlling display. nsecBitarray Bit array representing the different record types configured for the domain name domain Domain name that belongs to the given zone nextRecs An array of record types associated with the nsec record. stateflag flags controlling display count Example show dns zone foo.bar
Related Commands add dns zone set dns zone unset dns zone rm dns zone sign dns zone unsign dns zone
add dns key

Synopsis add dns key <keyName> <publickey> <privatekey> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [-TTL <secs>] Description Add a DNSKEY on NetScaler
Arguments keyName The name given to a public/private key pair. publickey File name of the public key to be used for signing zone privatekey File name of the private key to be used for signing zone expires Number of days since signing with a key, when the key expires. Default value: 120 Minimum value: 1 Maximum value: 32767 notificationPeriod Number of days before the expiry of a key, when an notification should be generated. Default value: 7 Minimum value: 1 Maximum value: 32767 TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/ secure.example-rsasha1-1024.private
Related Commands create dns key set dns key unset dns key rm dns key show dns key
create dns key

Synopsis create dns key -zoneName <string> -keyType <keyType> -algorithm RSASHA1 -keySize <positive_integer> fileNamePrefix <string> Description Create a public-private key for dnssec operations. Arguments zoneName The name of the zone for which the key is being added. keyType The type of key. Possible values: KSK, KeySigningKey, ZSK, ZoneSigningKey Default value: NS_DNSKEY_ZSK algorithm The type of algorithm to be generated. Possible values: RSASHA1 Default value: NS_DNSKEYALGO_RSASHA1
keySize The size in bits of the key to be created. Default value: 512 fileNamePrefix The string to be used as file name for the generated public, private and ds key files. Example create dns key -zone dnssec.bar -algorithm RSASHA1 -keySize 1024
Related Commands add dns key set dns key unset dns key rm dns key show dns key
set dns key

Synopsis set dns key <keyName> [-expires <positive_integer> [<units>]] [-notificationPeriod <positive_integer> [<units>]] [TTL <secs>] Description Add a DNSKEY on NetScaler Arguments keyName The name given to a public/private key pair. expires Number of days since signing with a key, when the key expires. Default value: 120 Minimum value: 1 Maximum value: 32767 notificationPeriod Number of days before the expiry of a key, when an notification should be generated. Default value: 7 Minimum value: 1 Maximum value: 32767 TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 Example add dns key secure.example.zsk -public secure.example-rsasha1-1024.key -private /nsconfig/dns/ secure.example-rsasha1-1024.private
Related Commands add dns key create dns key unset dns key
rm dns key show dns key
unset dns key

Synopsis unset dns key <keyName> [-expires] [-units] [-notificationPeriod] [-units] [-TTL] Description Use this command to remove dns key settings.Refer to the set dns key command for meanings of the arguments. Arguments Example
Related Commands add dns key create dns key set dns key rm dns key show dns key
rm dns key
Synopsis rm dns key <keyName> Description Remove a DNSKEY on NetScaler Arguments keyName The name given to a public/private key pair. Example rm dns key secure.example.zsk
Related Commands add dns key create dns key set dns key unset dns key show dns key
show dns key

Synopsis show dns key [<keyName>] Description Show a DNSKEY's on NetScaler Arguments keyName The name of the key whose info is to be displayed. summary fullValues format level publickey File name of the public key to be used for signing zone privatekey File name of the private key to be used for signing zone expires Number of days since signing with this key, when the key expires. units expiry time units notificationPeriod Number of days before the expiry of a key, when an notification should be generated. units notify time units TTL Time to live, in seconds. count stateflag Example show dns key
Related Commands add dns key create dns key set dns key unset dns key rm dns key
flush dns proxyRecords

Synopsis flush dns proxyRecords Description Flush all the DNS proxy records. Arguments Example
Related Commands
stat dns records

Synopsis stat dns records [<dnsRecordType>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics for DNS records. Arguments dnsRecordType DNS Record/Query type count devno stateflag Total entries (totEntries) Total number of DNS record entries Total updates (totUpdates) Total number of DNS proactive updates Total responses (totResp) Total number of DNS server responses Total requests (totReq) Total number of DNS queries recieved Current entries (curEnt) Current number of DNS entries Total limit errors (errLim) Total number of times we have recieved dns record with more entries than we support Total response format errors (errRespFor) Total number of times we have recieved malformed responses from the backend
Total alias exist errors (errAlias) Total number of times we have recieved non-cname record for a domain for which an alias exists Total cache misses (errNoDom) Total number of cache misses Current records (curRec) Current number of DNS Records Example
Related Commands stat dns stat dns policylabel
show dns stats

Synopsis show dns stats - alias for 'stat dns' Description show dns stats is an alias for stat dns Arguments Example
Related Commands stat dns
set dns parameter

Synopsis set dns parameter [-retries <positive_integer>] [-minTTL <secs>] [-maxTTL <secs>] [-cacheRecords ( YES | NO )] [-nameLookupPriority ( WINS | DNS )] [-recursion ( ENABLED | DISABLED )] [-resolutionOrder <resolutionOrder>] [-dnssec ( ENABLED | DISABLED )] [-maxPipeline <positive_integer>] [-dnsRootReferral ( ENABLED | DISABLED )] Description Set TTL parameters. Arguments retries The DNS resolver request retry count. Default value: 5 Minimum value: 1 Maximum value: 5 minTTL The minimum time to live value, in seconds. If any DNS entry has a time to live value of less than the minimum, it is saved as the minimum time to live value. Maximum value: 604800
maxTTL The maximum time to live value allowed, in seconds. If the DNS entry has a time to live value of more than the maximum, it is saved as the maximum time to live value. Default value: 604800 Minimum value: 1 Maximum value: 604800 cacheRecords The state of dns records caching. Possible values: YES, NO Default value: ENABLED nameLookupPriority The name lookup priority, as DNS or WINS. Possible values: WINS, DNS Default value: NS_WINSFIRST recursion Allow recursive name resolution by NetScaler. Possible values: ENABLED, DISABLED Default value: DISABLED resolutionOrder The order in which DNS resolver send A/AAAA query for the domain. Possible values: OnlyAQuery, OnlyAAAAQuery, AThenAAAAQuery, AAAAThenAQuery Default value: NS_FOUR dnssec To enable the DNS security extensions Possible values: ENABLED, DISABLED Default value: ENABLED maxPipeline To set the maximum value of the concurrent DNS pipeline. A setting of zero makes the pipeline infinite Default value: NSNATPCB_MAXPIPELINE dnsRootReferral This option is used to enable/disable the sending NS root referrals. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands unset dns parameter show dns parameter
unset dns parameter

Synopsis unset dns parameter [-retries] [-minTTL] [-maxTTL] [-cacheRecords] [-nameLookupPriority] [-recursion] [resolutionOrder] [-dnssec] [-maxPipeline] [-dnsRootReferral] Description Use this command to remove dns parameter settings.Refer to the set dns parameter command for meanings of the arguments. Arguments Example
Related Commands set dns parameter show dns parameter
show dns parameter

Synopsis show dns parameter Description Display dns parameter. Displays the following value: DNS Retries - The DNS resolver request timeout. minTTL - The minimum allowed value for time to live. If a DNS entry has a time to live value less than the minimum, it is saved as the minimum time to live. maxTTL - The maximum allowed value for time to live. If any DNS entry has a time to live value less than the maximum, it is saved as the maximum time to live. Arguments format level retries The DNS resolver request retry count. minTTL The minimum time to live value, in seconds. If any DNS entry has a time to live value of less than the minimum, it is saved as the minimum time to live value. maxTTL The maximum time to live value allowed, in seconds. If the DNS entry has a time to live value of more than the maximum, it is saved as the maximum time to live value. nameLookupPriority The name lookup priority, as DNS or WINS. cacheRecords The state of dns records caching. recursion Allow recursive name resolution by NetScaler. resolutionOrder The order in which DNS resolver send A/AAAA query for the domain. dnssec To enable the DNS security extensions maxPipeline Maximum value of the concurrent DNS pipeline. A setting of zero makes the pipeline infinite dnsRootReferral This option is used to enable/disable the sending NS root referrals. Example
Related Commands set dns parameter
unset dns parameter
add dns policylabel

Synopsis add dns policylabel <labelName> <transform> Description Add a dns policy label. Arguments labelName Name of the dns policy label. transform The type of transformations allowed by the policies bound to the label. Possible values: dns_req, dns_res Example add dns policylabel trans_dns dns_req
Related Commands rm dns policylabel bind dns policylabel unbind dns policylabel show dns policylabel stat dns policylabel rename dns policylabel
rm dns policylabel
Synopsis rm dns policylabel <labelName> Description Remove a dns policy label. Arguments labelName Name of the dns policy label. Example rm dns policylabel trans_dns
Related Commands add dns policylabel
bind dns policylabel unbind dns policylabel show dns policylabel stat dns policylabel rename dns policylabel
bind dns policylabel

Synopsis bind dns policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the dns policy to one of the labels. Arguments labelName Name of the dns policy label. policyName The dns policy name. Example i) bind dns policylabel trans_dns pol_1 1 2 -invoke reqvserver CURRENT ii) bind rewrite policylabel trans_http_url pol_2 2
Related Commands add dns policylabel rm dns policylabel unbind dns policylabel show dns policylabel stat dns policylabel rename dns policylabel
unbind dns policylabel

Synopsis unbind dns policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind entities from dns label. Arguments labelName Name of the dns policy label. policyName
The dns policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind dns policylabel trans_dns pol_1
Related Commands add dns policylabel rm dns policylabel bind dns policylabel show dns policylabel stat dns policylabel rename dns policylabel
show dns policylabel

Synopsis show dns policylabel [<labelName>] Description Display policy label or policies bound to dns policylabel. Arguments labelName Name of the dns policy label. summary fullValues format level stateflag transform The type of transformations allowed by the policies bound to the label. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The dns policy name. priority Specifies the priority of the policy. gotoPriorityExpression
Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound dns policy. description Description of the policylabel isDefault A value of true is returned if it is a default dns policylabel. flags count Example i) show dns policylabel trans_dns ii) show dns policylabel
Related Commands add dns policylabel rm dns policylabel bind dns policylabel unbind dns policylabel stat dns policylabel rename dns policylabel
stat dns policylabel

Synopsis stat dns policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of dns policylabel(s). Arguments labelName The name of the dns policy label for which statistics will be displayed. If not given statistics are shown for all dns policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked.
Example
Related Commands add dns policylabel rm dns policylabel bind dns policylabel unbind dns policylabel show dns policylabel rename dns policylabel stat dns stat dns records
rename dns policylabel

Synopsis rename dns policylabel <labelName>@ <newName>@ Description Rename a dns policy label. Arguments labelName The name of the dns policylabel. newName The new name of the dns policylabel. Example rename dns policylabel oldname newname
Related Commands add dns policylabel rm dns policylabel bind dns policylabel unbind dns policylabel show dns policylabel stat dns policylabel
bind dns global

Synopsis bind dns global <policyName> <priority> [-gotoPriorityExpression <string>] [-type <type>] [-invoke (<labelType> <labelName>) ]
Description Binds the DNS policy with the given priority. Arguments policyName The name of the policy to be bound to dns global. Example bind dns global pol9 9 Related Commands unbind dns global show dns global
unbind dns global

Synopsis unbind dns global <policyName> Description Unbinds the DNS policy with the given priority. Arguments policyName Name of the policy to be bound to dns global. Example unbind dns global pol9 Related Commands bind dns global show dns global
show dns global

Synopsis show dns global [-type <type>] Description Display the DNS global bindings. Arguments type Bindpoint, specifying where to bind the policy. Possible values: REQ_OVERRIDE, REQ_DEFAULT, RES_OVERRIDE, RES_DEFAULT summary fullValues
format level stateflag policyName Name of the dns policy. priority Specifies the priority of the policy with which it is bound. Maximum allowed priority should be less than 65535 gotoPriorityExpression Expression which evaluates to a priority which must be executed next. By default it goes to priority 65535. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. numpol The number of policies bound to the bindpoint. flowType flowtype of the bound rewrite policy. flags upgraded It is internally used to tell that the policy is a upgraded policy. count Example show dns global show dns global -type REQ_DEFAULT show dns global -type RES_DEFAULT
Related Commands bind dns global unbind dns global
add dns action

Synopsis add dns action <actionName> <actionType> (-IPAddress <ip_addr|ipv6_addr> ... | -viewName <string> | preferredLocList <string> ...) [-TTL <secs>] Description Add a dns action. Arguments actionName Name of the dns action.
actionType The type of DNS action that is being configured. Possible values: ViewName, GslbPrefLoc, Drop, Cache_Bypass, Rewrite_Response IPAddress List of IP address to be returned in case of rewrite_response actiontype. They can be of IPV4 or IPV6 type. In case of set command We will remove all the IP address previously present in the action and will add new once given in set dns action command. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 viewName The view name that must be used for the given action. preferredLocList The location list in priority order used for the given action. Example add dns action <actionName> <actionType> (-IPAddress <ip_addr|ipv6_addr> ... | viewName <string> | -preferredLocList <string> ...) [-TTL <secs>] add dns action action1 Rewrite_Response -ipAddress 10.102.27.153 10.102.27.154 33::33 44::44 -TTL 4000 add dns action action1 GslbPrefLoc -preferredLocList india.10.102.81.175.80 us.10.102.81.176.80 add dns action action1 ViewName -viewName dnsview1 Related Commands rm dns action set dns action unset dns action show dns action
rm dns action
Synopsis rm dns action <actionName> Description Removes a dns Action. Arguments actionName Name of the dns action. Example rm dns action action1 Related Commands add dns action set dns action unset dns action
show dns action
set dns action

Synopsis set dns action <actionName> [-IPAddress <ip_addr|ipv6_addr> ...] [-TTL <secs>] [-viewName <string>] [preferredLocList <string> ...] Description Set a dns Action. Use this command to set the values for Ip address and TTL, If Ipaddress is given in set dns action command we will discard the previous set and will apply this new set of ipaddress given. Arguments actionName Name of the dns action. IPAddress List of IP address to be returned in case of rewrite_response actiontype. They can be of IPV4 or IPV6 type. In case of set command We will remove all the IP address previously present in the action and will add new once given in set dns action command. TTL Time to live, in seconds. Default value: 3600 Maximum value: 2147483647 viewName The view name that must be used for the given action. preferredLocList The location list in priority order used for the given action. Example set dns action <actionName> [-IPAddress <ip_addr|ipv6_addr> ...] [-TTL <secs>] [-viewName <string>] [-preferredLocList <string> ...] set dns action action1 -ipAddress 10.102.27.153 10.102.27.154 33::33 44::44 -TTL 4000 set dns action action1 -viewName dnsview2 set dns action action1 -preferredLocList india.10.102.81.175.80
Related Commands add dns action rm dns action unset dns action show dns action
unset dns action

Synopsis unset dns action <actionName> -TTL Description Use this command to remove dns action settings.Refer to the set dns action command for meanings of the arguments.
Arguments Example
Related Commands add dns action rm dns action set dns action show dns action
show dns action

Synopsis show dns action [<actionName>] Description Used to display the action-related information. Arguments actionName Name of the dns action. format level actionType The type of DNS action that is being configured. TTL Time to live, in seconds. IPAddress List of IP address to be returned in case of rewrite_response actiontype. They can be of IPV4 or IPV6 type. In case of set command We will remove all the IP address previously present in the action and will add new once given in set dns action command. viewName The view name that must be used for the given action. preferredLocList The location list in priority order used for the given action. drop The dns packet must be dropped. cacheBypass By pass dns cache for this. count stateflag Example show dns action <Action-Name> show dns action action1 show dns action
Related Commands add dns action rm dns action set dns action unset dns action
show dns nsecRec

Synopsis show dns nsecRec [<hostName> | -type <type>] Description Show the nsec records on NetScaler Arguments hostName The domain name whose info is to be displayed. type NSEC record type. The type can take 3 values: ADNS - If this is specified, all of the authoritative NSEC records will be displayed. PROXY - If this is specified, all of the proxy NSEC records will be displayed. ALL - If this is specified, all of the NSEC records will be displayed. Possible values: ALL, ADNS, PROXY summary fullValues nextNsec Next nsec record in the chain nsecBitarray Bit array representing the different record types configured for the domain name nextRecs An array of record types associated with the nsec record. count stateflag Example show dns nsecRec foo.bar
Related Commands
Chapter
18
DataStream commands
Topics: add db user rm db user set db user show db user
534 | Citrix NetScaler 10 | DataStream commands
add db user
Synopsis add db user <userName> {-password } Description Add a database user. Arguments userName The name of the user. password Enter this keyword to create or change the user's password. The entered password is not displayed. Example add db user johndoe -password secret Related Commands rm db user set db user show db user
rm db user
Synopsis rm db user <userName> Description Remove the database user. Arguments userName The name of the database user. Example
Related Commands add db user set db user show db user
set db user
Synopsis set db user <userName>
Citrix NetScaler 10 | DataStream commands | 535
Description Modify the parameters for the existing DB user. Arguments userName The name of the user. password The password of the database user Example set db user johndoe The above command sets the password for johndoe to abcd (Password to be suplied on prompt)
Related Commands add db user rm db user show db user
show db user
Synopsis show db user [<userName>] [-loggedIn] Description Display the database user detail. Arguments userName The user name. loggedIn The loggedin flag. When this flag is turned on, the system displays the names of all logged-in users. If a user name is included, the system displays whether the user is logged in or not. summary fullValues format level count stateflag Example
Related Commands add db user
536 | Citrix NetScaler 10 | DataStream commands
rm db user set db user
Chapter
19
DoS Commands
Topics: stat dos add dos policy rm dos policy set dos policy unset dos policy show dos policy stat dos policy show dos stats
538 | Citrix NetScaler 10 | DoS Commands
stat dos
Synopsis stat dos [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display DOS statistics. Arguments DOS condition triggered (CndMatch) Number of times the NetScaler appliance triggered the DOS JavaScript due to a condition match. Valid DOS clients (ValidClt) Number of clients from whom the NetScaler appliance received a valid DOS cookie. DOS priority clients (DosPriCl) Number of valid clients that were given DOS priority. Example
Related Commands stat dos policy
add dos policy

Synopsis add dos policy <name> -qDepth <positive_integer> [-cltDetectRate <positive_integer>] Description Add a DoS protection policy to the system. Arguments name The name of the DoS protection policy. qDepth The queue size (the number of outstanding service requests on the system) that must be reached before DoS protection is activated on the service to which the DoS protection policy is bound. Note: For the DoS protection to be applied on a service, the service must have a DoS policy bound to it. This is done with the ###bind service### command. Minimum value: 21 cltDetectRate The client detect rate is the percentage of traffic to apply the DOS policy. Maximum value: 100 Example add dos policy dospol -qdepth 100 -cltDetectRate 90
Related Commands rm dos policy
Citrix NetScaler 10 | DoS Commands | 539
set dos policy unset dos policy show dos policy stat dos policy
rm dos policy
Synopsis rm dos policy <name> Description Remove the specified DoS protection policy. Arguments name The name of the DoS protection policy. Example rm dos policy dospol
Related Commands add dos policy set dos policy unset dos policy show dos policy stat dos policy
set dos policy

Synopsis set dos policy <name> [-qDepth <positive_integer>] [-cltDetectRate <positive_integer>] Description Modify the parameters for the specified DoS protection policy. Arguments name The name of the DoS protection policy to be modified. qDepth The queue size (the outstanding requests on this service queued in the system, waiting to be sent to the server) that must be reached before DoS protection is activated on the service. For DoS protection to be activated on a service, this policy needs to be bound to the service using the ###bind service### command. Minimum value: 21 cltDetectRate The client detect rate. Client detect rate is the percentage of traffic to apply the DOS policy. Minimum value: 1 Maximum value: 100
Example set dos policy dospol -qdepth 1000
Related Commands add dos policy rm dos policy unset dos policy show dos policy stat dos policy
unset dos policy

Synopsis unset dos policy <name> -cltDetectRate Description Use this command to remove dos policy settings.Refer to the set dos policy command for meanings of the arguments. Arguments Example
Related Commands add dos policy rm dos policy set dos policy show dos policy stat dos policy
show dos policy

Synopsis show dos policy [<name>] Description Display the configured DoS protection policy. Arguments name The name of DoS policy. summary
fullValues format level qDepth The queue size (the outstanding requests on this service queued in the system, waiting to be sent to the server) that must be reached before DoS protection is activated on the service. For DoS protection to be activated on a service, this policy needs to be bound to the service using the ###bind service### command. cltDetectRate The client detect rate is the percentage of traffic to apply the DOS policy. count stateflag Example > show dos policy 1 configured DoS policy: 1) Policy: dospol QDepth: 100 ClientDetectRate: 90 Done
Related Commands add dos policy rm dos policy set dos policy unset dos policy stat dos policy
stat dos policy

Synopsis stat dos policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display DOS policy statistics. Arguments name The name of the DoS policy for which statistics will be displayed. If a name is not given, statistics are shown for all DoS policies. count devno stateflag Client detect rate (ClDtRate) Current ratio of JavaScript send rate to the server response rate (Client detect rate) Physical service IP (SvcIP)
IP address of the service to which this policy is bound. Physical service port (SvcPort) Port address of the service to which this policy is bound. Current server queue size (CurQSize) Current queue size of the server to which this policy is bound. DOS transactions (DosTrans) Total number of DoS JavaScript transactions performed for this policy. Client detect rate mismatch (JsRefusd) Number of times the DoS JavaScript was not sent because the set JavaScript rate was not met for this policy. Valid clients (TotValCl) Total number of valid DoS cookies received for this policy. DOS JavaScript bytes served (JsBytSnt) Total number of DoS JavaScript bytes sent for this policy. Non GET, POST requests Number of non-GET and non-POST requests for which DOS JavaScript was sent. DOS JavaScript send rate (JSRate) Current rate at which JavaScript is being sent in response to client requests. Server response rate (RespRate) Current rate at which the server to which this policy is bound is responding. Example
Related Commands add dos policy rm dos policy set dos policy unset dos policy show dos policy stat dos
show dos stats

Synopsis show dos stats - alias for 'stat dos' Description show dos stats is an alias for stat dos Arguments Example
Related Commands stat dos
Chapter
20
Filter Commands
Topics: add filter action rm filter action set filter action unset filter action show filter action add filter htmlinjectionvariable rm filter htmlinjectionvariable set filter htmlinjectionvariable unset filter htmlinjectionvariable show filter htmlinjectionvariable add filter policy rm filter policy set filter policy unset filter policy show filter policy set filter prebodyInjection unset filter prebodyInjection show filter prebodyInjection set filter postbodyInjection unset filter postbodyInjection show filter postbodyInjection set filter htmlinjectionparameter unset filter htmlinjectionparameter show filter htmlinjectionparameter bind filter global unbind filter global show filter global
546 | Citrix NetScaler 10 | Filter Commands
add filter action

Synopsis add filter action <name> <qual> [<serviceName>] [<value>] [<respCode>] [<page>] Description Create a content filtering action. The action thus created can be associated with the content filtering policy. The two built-in filter actions RESET and DROP are always present on the system. Use the RESET filter action to send a TCP reset for the HTTP requests. Use the DROP filter action to drop the HTTP requests silently without sending a TCP FIN for closing the connection. Arguments name The name for the filter action. qual The name of the qualifier. Possible values: reset, add, corrupt, forward, errorcode, drop serviceName The service to which HTTP requests are forwarded. This parameter is required when the qualifier is FORWARD. value The string containing the header_name and header_value. When the qualifier is ADD use this option as header_name:header_value. When the qualifier is Corrupt use this option to specify only the header_name. respCode The response code to be returned for HTTP requests. Use this parameter when the qualifier is ERRORCODE. Minimum value: 1 page The HTML page that will be returned for the HTTP requests. Use this parameter when the qualifier is ERRORCODE. Example add filter action bad_url_action errorcode 400 "<HTML>Bad URL.</HTML>" add filter action forw_action FORWARD service1 add filter action add_header_action add "HEADER:value"
Related Commands rm filter action set filter action unset filter action show filter action
rm filter action
Synopsis rm filter action <name>
Citrix NetScaler 10 | Filter Commands | 547
Description Remove a created filter action. Arguments name The name of the filter action. Example rm filter action filter_action_name
Related Commands add filter action set filter action unset filter action show filter action
set filter action

Synopsis set filter action <name> [-serviceName <string>] [-value <string>] [-respCode <positive_integer>] [-page <string>] Description Modify an existing content filtering action. Arguments name The name for the filter action. serviceName The service to which HTTP requests are forwarded. This parameter can be set only when the action qualifier is FORWARD. value The string containing the header_name and header_value. When the qualifier is ADD use this option as header_name:header_value. When the qualifier is Corrupt use this option to specify only the header_name. respCode The response code to be returned for HTTP requests. Use this parameter when the qualifier is ERRORCODE. Minimum value: 1 page The HTML page that will be returned for the HTTP requests. Use this parameter when the action qualifier is ERRORCODE. Example set filter action bad_url_action -respcode 400 -page "<HTML>Bad URL.</HTML>" set filter action forw_action -serviceName service1 set filter action add_header_action -value "HEADER:value"
Related Commands add filter action rm filter action unset filter action show filter action
unset filter action

Synopsis unset filter action <name> -page Description Use this command to remove filter action settings.Refer to the set filter action command for meanings of the arguments. Arguments Example
Related Commands add filter action rm filter action set filter action show filter action
show filter action

Synopsis show filter action [<name>] Description Display the created filter actions. The filter actions RESET and DROP are always displayed, irrespective of whether an action has been defined. They are built-in actions and cannot be modified. Arguments name The name for the filter action. summary fullValues format level qual The name of the qualifier.
serviceName The service to which HTTP requests are forwarded. This parameter will exist when the qualifier is FORWARD. value The string containing the header_name and header_value. When the qualifier is ADD it will have header_name:header_value. When the qualifier is Corrupt this will have header_name. respCode The response code to be returned for HTTP requests. This parameter will exist when the qualifier is ERRORCODE. page The HTML page that will be returned for the HTTP requests. This parameter will exist when the qualifier is ERRORCODE. stateflag isDefault A value of true is returned if it is a default filteraction. flag count Example Example 1 The following shows an example of the output of the show filter action command when no filter actions have been defined: 1) Name: RESET Filter Type: reset 2) Name: DROP Filter Type: drop Done Example 2 The following command creates a filter action: add filter action bad_url_action errorcode 400 "<HTML>Bad URL.</HTML>" The following shows an example of the output of the show filter action command after the previous command has been issued: Name: bad_url_action Filter Type: errorcode StatusCode: 400 Response Page: <HTML>Bad URL.</HTML> Done
Related Commands add filter action rm filter action set filter action unset filter action
add filter htmlinjectionvariable

Synopsis add filter htmlinjectionvariable <variable> [-value <string>] Description Add a new HTML injection variable Arguments variable The name of the HTML injection variable to be added. value
Value to be assigned to the new variable. builtin Indicates that a variable is a built-in (SYSTEM INTERNAL) type. varId ID of the system variable. Used only in builtins. Possible values: IID, UTIME, XID, PAGEID, REQRTBEG, REQRTEND, REQSTBEG, REQSTEND, RESRTBEG, RESRTEND, RESSTBEG, RESSTEND, CLTRTT, CTYPE, TRANSID, SYSVSVR, SYSSERV Example add htmlinjectionvariable EDGESIGHT_SERVER_IP -value 1.1.1.1 Related Commands rm filter htmlinjectionvariable set filter htmlinjectionvariable unset filter htmlinjectionvariable show filter htmlinjectionvariable
rm filter htmlinjectionvariable
Synopsis rm filter htmlinjectionvariable <variable> Description Remove a HTML injection variable Arguments variable The name of the HTML injection variable to be removed. Example rm htmlinjectionvariable EDGESIGHT_SERVER_IP Related Commands add filter htmlinjectionvariable set filter htmlinjectionvariable unset filter htmlinjectionvariable show filter htmlinjectionvariable
set filter htmlinjectionvariable

Synopsis set filter htmlinjectionvariable <variable> [-value <string>] Description Set the value of a HTML injection variable
Arguments variable The name of the HTML injection variable to be set. value Value to be set in the new variable. Example set htmlinjectionvariable EDGESIGHT_SERVER_IP -value 2.2.2.2
Related Commands add filter htmlinjectionvariable rm filter htmlinjectionvariable unset filter htmlinjectionvariable show filter htmlinjectionvariable
unset filter htmlinjectionvariable

Synopsis unset filter htmlinjectionvariable <variable> -value Description Use this command to remove filter htmlinjectionvariable settings.Refer to the set filter htmlinjectionvariable command for meanings of the arguments. Arguments Example
Related Commands add filter htmlinjectionvariable rm filter htmlinjectionvariable set filter htmlinjectionvariable show filter htmlinjectionvariable
show filter htmlinjectionvariable

Synopsis show filter htmlinjectionvariable [<variable>] Description Display HTML injection variable Arguments variable
The name of the HTML injection variable to be displayed. summary fullValues format level value Value of the HTML injection variable type Type of the HTML injection variable count stateflag Example show htmlinjectionvariable EDGESIGHT_SERVER_IP
Related Commands add filter htmlinjectionvariable rm filter htmlinjectionvariable set filter htmlinjectionvariable unset filter htmlinjectionvariable
add filter policy

Synopsis add filter policy <name> -rule <expression> (-reqAction <string> | -resAction <string>) Description Create a content filtering policy. Arguments name The name of the new filter policy. rule The expression which sets the condition for application of the policy. reqAction The name of the action to be performed on the request. The string value can be a created filter action or one of the following built-in actions: RESET - Sends the TCP reset and closes the connection to the peer. DROP - Silently closes the connection to the peer without sending the TCP FIN. Note that the request action can not be specified if the rule has some condition to be evaluated for response. resAction The action to be performed on the response. The string value can be a filter action created filter action or a built-in action.
Example Example 1: add policy expression e1 "sourceip == 66.33.22.0 -netmask 255.255.255.0" add policy expression e2 "URL == /admin/account.asp" add filter policy ip_filter -rule "e1 && e2" -reqAction RESET After creating above filter policy, it can be activated by binding it globally: bind filter global ip_filter With the configured ip_filter (name of the filter policy), the NetScaler system sends a TCP reset to all HTTP requests for the /admin/account.asp URL from 66.33.22.0 Class C network. This action is applied at the HTTP request time. Example 2: To silently drop (without sending FIN) all the HTTP requests in which the URL has root.exe or cmd.exe, below filter policy can be configured: add filter policy nimda_filter -rule "URL contains root.exe || URL contains cmd.exe" -reqAction DROP bind filter global nimda_filter Example 3: add filter policy url_filter -rule "url == /foo/secure.asp && SOURCEIP != 65.186.55.0 -netmask 255.255.255.0 && SOURCEIP != 65.202.35.0 -netmask 255.255.255.0" -reqaction RESET bind filter global url_filter With the above configured filter policy named url_filter, the NetScaler system sends RESET to all HTTP requests for the URL /foo/secure.asp from all the networks except from 65.186.55.0 and 65.202.35.0 Class C networks. This action is applied at the HTTP request time. Note: In above examples, the RESET and DROP are built-in actions in the NetScaler system. "show filter action" and "show filter policy" CLI commands show the configured filter actions and policies in NetScaler system respectively. "show filter global" command shows all the globallyactive filter policies.
Related Commands rm filter policy set filter policy unset filter policy show filter policy
rm filter policy
Synopsis rm filter policy <name> Description Remove a filter policy. Arguments name The name of filter policy. Example rm filter policy filter_policy_name The "show filter policy" command shows all filter policies that are currently defined.
Related Commands add filter policy set filter policy unset filter policy show filter policy
set filter policy

Synopsis set filter policy <name> [-rule <expression>] [-reqAction <string> | -resAction <string>] Description Modify the created filter policy. Arguments name The name of the filter policy. rule The expression which sets the condition for application of the policy. reqAction Request action. resAction Response action. Example Example 1: A filter policy to allow access of URL /foo/secure.asp only from 65.186.55.0 network can be created using below command: add filter policy url_filter -rule "URL == /foo/ secure.asp && SOURCEIP != 65.186.55.0 -netmask 255.255.255.0" -reqAction RESET This policy is activated using: bind filter global url_filter Later, to allow access of this url from second network 65.202.35.0 too, above filter policy can be changed by issuing below command: set filter policy url_filter -rule "URL == /foo/secure.asp && SOURCEIP != 65.186.55.0 -netmask 255.255.255.0 && SOURCEIP != 65.202.35.0 -netmask 255.255.255.0" Changed filter policy can be viewed by using following command: show filter policy url_filter Name: url_filter Rule: (URL == /foo/secure.asp && (SOURCEIP != 65.186.55.0 -netmask 255.255.255.0 && SOURCEIP != 65.202.35.0 -netmask 255.255.255.0)) Request action: RESET Response action: Hits: 0 Done
Related Commands add filter policy rm filter policy unset filter policy show filter policy
unset filter policy

Synopsis unset filter policy <name> [-rule] [-reqAction] [-resAction] Description Use this command to remove filter policy settings.Refer to the set filter policy command for meanings of the arguments.
Arguments Example
Related Commands add filter policy rm filter policy set filter policy show filter policy
show filter policy

Synopsis show filter policy [<name>] Description Display the filter policies. Arguments name The name of the filter policy. summary fullValues format level rule The expression which sets the condition for application of the policy. reqAction The name of the action to be performed on the request. resAction The action to be performed on the response. hits boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag
Example show filter policy 1) Name: nimda_filter Rule: (URL CONTAINS root.exe || URL CONTAINS cmd.exe) Request action: RESET Response action: Hits: 0 2) Name: ip_filter Rule: (src_ips && URL == /admin/account.asp) Request action: RESET Response action: Hits: 0 Done Individual filter policy can also be viewed by giving filter policy name as argument: show filter policy ip_filter Name: ip_filter Rule: (src_ips && URL == /admin/account.asp) Request action: RESET Response action: Hits: 0 Done
Related Commands add filter policy rm filter policy set filter policy unset filter policy
set filter prebodyInjection

Synopsis set filter prebodyInjection <prebody> Description Set file name for prebody Arguments prebody The file name for prebody. Example set filter prebodyInjection ens/prebody.js
Related Commands unset filter prebodyInjection show filter prebodyInjection
unset filter prebodyInjection

Synopsis unset filter prebodyInjection Description Unset file name for prebody.Refer to the set filter prebodyInjection command for meanings of the arguments. Arguments Example unset filter prebodyInjection
Related Commands set filter prebodyInjection show filter prebodyInjection
show filter prebodyInjection

Synopsis show filter prebodyInjection Description Display the file for prebody. Arguments format level prebody The name of the prebody file. systemIID The system IID of the current NetScaler system. Example
Related Commands set filter prebodyInjection unset filter prebodyInjection
set filter postbodyInjection

Synopsis set filter postbodyInjection <postbody> Description Unset file name for postbody Arguments postbody The file name for postbody. Example set filter postbodyInjection ens/postbody.js
Related Commands unset filter postbodyInjection show filter postbodyInjection
unset filter postbodyInjection

Synopsis unset filter postbodyInjection Description Remove file name for prebody.Refer to the set filter postbodyInjection command for meanings of the arguments. Arguments Example unset filter postbodyInjection
Related Commands set filter postbodyInjection show filter postbodyInjection
show filter postbodyInjection

Synopsis show filter postbodyInjection Description Display the file for postbody. Arguments format level postbody The name of the postbody file. systemIID The system IID of the current NetScaler system. Example
Related Commands set filter postbodyInjection unset filter postbodyInjection
set filter htmlinjectionparameter

Synopsis set filter htmlinjectionparameter [-rate <positive_integer>] [-frequency <positive_integer>] [-strict ( ENABLED | DISABLED )] [-htmlsearchlen <positive_integer>]
Description Set the various HTML injection parameters Arguments rate if rate is X, HTML injection will be done for 1 out of X policy matches Default value: 1 Minimum value: 1 frequency if frequency is X, HTML injection will be done atleast once per X milisecond Default value: 1 Minimum value: 1 strict enable/disable searching for <html> tag for HTML injection Possible values: ENABLED, DISABLED Default value: ENABLED htmlsearchlen HTTP body length in which to search for <html> tag Default value: 1024 Minimum value: 1 Example set htmlinjection parameter -rate 10 -frequency 1
Related Commands unset filter htmlinjectionparameter show filter htmlinjectionparameter
unset filter htmlinjectionparameter

Synopsis unset filter htmlinjectionparameter [-rate] [-frequency] [-strict] [-htmlsearchlen] Description Unset the previously set HTML injection parameters.Refer to the set filter htmlinjectionparameter command for meanings of the arguments. Arguments Example a) unset htmlinjectionparameter -rate b) unset htmlinjectionparameter -frequency c) unset htmlinjectionparameter -rate -frequency
Related Commands set filter htmlinjectionparameter show filter htmlinjectionparameter
show filter htmlinjectionparameter

Synopsis show filter htmlinjectionparameter
Description Display the HTML injection parameters Arguments format level rate if rate is X, HTML injection will be done for 1 out of X policy matches frequency if frequency is X, HTML injection will be done atleast once per X milisecond strict enable/disable searching for <html> tag for HTML injection htmlsearchlen HTTP body length in which to search for <html> tag Example rate : 10
Related Commands set filter htmlinjectionparameter unset filter htmlinjectionparameter
bind filter global

Synopsis bind filter global (<policyName> [-priority <positive_integer>]) [-state ( ENABLED | DISABLED )] Description Activate the filter policy globally.Note that the content filtering license is required for filtering. Arguments policyName The name of the filter policy to be bound. Example To send RESET for all the HTTP requests which are not get or head type, following filter policy can be created: add filter policy reset_invalid_req -rule "METHOD != GET && METHOD != HEAD" -reqAction RESET This filter policy can be activated globally for NetScaler system by giving command: bind filter global reset_invalid_req Globally active filter policies can be seen using command: show filter global 1) Policy Name: reset_invalid_req Priority: 0 Done
Related Commands unbind filter global show filter global
unbind filter global

Synopsis unbind filter global <policyName> Description Deactivate a filter policy globally. Arguments policyName The name of the filter policy to be unbound. Example Globally active filter policies can be seen using command: show filter global 1) Policy Name: reset_invalid_req Priority: 0 Done This globally active filter policy can be deactivated on NetScaler system by giving command: unbind filter global reset_invalid_req
Related Commands bind filter global show filter global
show filter global

Synopsis show filter global Description Display the globally activated filter policies. Arguments summary fullValues format level policyName The name of teh filter policy. priority The priority of the policy. state The state of the binding. count stateflag
Example show filter global 1) Policy Name: url_filter Priority: 0 2) Policy Name: reset_invalid_req Priority: 0 Done
Related Commands bind filter global unbind filter global
Chapter
21
Gslb Commands
Topics: add gslb site rm gslb site set gslb site unset gslb site show gslb site stat gslb site add gslb service rm gslb service set gslb service unset gslb service bind gslb service unbind gslb service show gslb service stat gslb service rename gslb service add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver add gslb policy rm gslb policy set gslb policy show gslb policy add gslb action rm gslb action set gslb action show gslb action show gslb runningConfig stat gslb domain
564 | Citrix NetScaler 10 | Gslb Commands
clear gslb ldnsentries show gslb ldnsentries set gslb parameter unset gslb parameter show gslb parameter rm gslb ldnsentry sync gslb config show gslb syncStatus
Citrix NetScaler 10 | Gslb Commands | 565
add gslb site

Synopsis add gslb site <siteName> [<siteType>] <siteIPAddress> [-publicIP <ip_addr|ipv6_addr|*>] [-metricExchange ( ENABLED | DISABLED )] [-nwMetricExchange ( ENABLED | DISABLED )] [-sessionExchange ( ENABLED | DISABLED )] [-triggerMonitor <triggerMonitor>] [-parentSite <string>] Description Add the site entity participating in GSLB in system Arguments siteName The name of the site that is participating in the GSLB siteType Specify whether the site is LOCAL or REMOTE. If this option is not specified, then it will be automatically detected whether the site should be considered LOCAL or REMOTE. This decision is based on whether the siteIPAddress is found to be already configured in the system, for e.g., MIP or SNIP Possible values: REMOTE, LOCAL Default value: NS_NORMAL siteIPAddress The IP address of the site. This IP address will be a System owned IP address. SNIP or MIP can be used as Site IP address publicIP The Public IP. This parameter is in effect only for a LOCAL site. This parameter is required only if the local System is in a private address space and has a public IP hosted on an external FW or NAT device. metricExchange The state of MEP. When metric exchange is DISABLED, then the site does not exchange metrics with other sites. When this option is disabled, a simple ROUNDROBIN method will be used for Global Server Load Balancing. Possible values: ENABLED, DISABLED Default value: ENABLED nwMetricExchange Disable or enable exchange of network metrics like RTT. Possible values: ENABLED, DISABLED Default value: ENABLED sessionExchange Disable or enable exchange of persistence session entries. Possible values: ENABLED, DISABLED Default value: ENABLED triggerMonitor A setting that defines when bound monitors if any should be triggered for services belonging to this site. Possible values: ALWAYS, MEPDOWN, MEPDOWN_SVCDOWN Default value: NSGSLB_TRIGMON_ALWAYS parentSite Parent site of this site. Example add site new_york LOCAL 192.168.100.12 -publicIP 65.200.211.139 Related Commands rm gslb site
set gslb site unset gslb site show gslb site stat gslb site
rm gslb site
Synopsis rm gslb site <siteName> Description Remove the site entity configured in system Arguments siteName The name of the site entity to be removed. When the site is removed, all the services created under that site will be removed. Example rm gslb site new_york
Related Commands add gslb site set gslb site unset gslb site show gslb site stat gslb site
set gslb site

Synopsis set gslb site <siteName> [-metricExchange ( ENABLED | DISABLED )] [-nwMetricExchange ( ENABLED | DISABLED )] [-sessionExchange ( ENABLED | DISABLED )] [-triggerMonitor <triggerMonitor>] Description Enable or disable the Metric Exchange between sites Arguments siteName The name of the site. metricExchange State of metric exchange for the site. If metric exchange is disabled, a simple ROUNDROBIN method is used to perform Global Server load balancing Possible values: ENABLED, DISABLED Default value: ENABLED nwMetricExchange
Disable or enable exchange of network metrics like RTT. Possible values: ENABLED, DISABLED Default value: ENABLED sessionExchange Disable or enable exchange of persistence session entries. Possible values: ENABLED, DISABLED Default value: ENABLED triggerMonitor A setting that defines when bound monitors if any should be triggered for services belonging to this site. Possible values: ALWAYS, MEPDOWN, MEPDOWN_SVCDOWN Default value: NSGSLB_TRIGMON_ALWAYS Example set gslb site new_york - metricExchange DISABLED
Related Commands add gslb site rm gslb site unset gslb site show gslb site stat gslb site
unset gslb site

Synopsis unset gslb site <siteName> [-metricExchange] [-nwMetricExchange] [-sessionExchange] [-triggerMonitor] Description Use this command to remove gslb site settings.Refer to the set gslb site command for meanings of the arguments. Arguments Example
Related Commands add gslb site rm gslb site set gslb site show gslb site stat gslb site
show gslb site

Synopsis show gslb site [<siteName>] show gslb site stats - alias for 'stat gslb site'
Description Display the configured site entities in system Arguments siteName The name of the site. If sitename is specified, all the services created under that site will be displayed. summary fullValues format level siteType Specifies whether the site is LOCAL or REMOTE. siteIPAddress The IP address of the site. publicIP The Public IP of the gslb site. metricExchange The state of MEP. When metric exchange is DISABLED, then the site does not exchange metrics with other sites. When this option is disabled, a simple ROUNDROBIN method will be used for Global Server Load Balancing. serviceName Service name. IPAddress IP Address of the gslb service. port Port number of the gslb service. state State of the gslb service. status Current metric exchange status. persistenceMEPStatus Network metric and persistence exchange MEP connection status serviceType Service type. nwMetricExchange Specifies whether the exchange of network metrics like RTT is enabled or disabled. sessionExchange Specifies whether the exchange of persistence session entries is enabled or disabled. triggerMonitor A setting that defines when bound monitors if any should be triggered for services belonging to this site. parentSite Parent site of this site.
cnameEntry The cname of the gslb service. stateflag stateflag version will be true if the remote site's version is ncore compatible with the local site.(>= 9.2) count Example show site new_york
Related Commands add gslb site rm gslb site set gslb site unset gslb site stat gslb site
stat gslb site

Synopsis stat gslb site [<siteName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display Gslb site statistics. Arguments siteName The name of the GSLB site for which statistics will be displayed. If not given statistics are shown for all gslb sites. count devno stateflag Gslb Site Public IP address (Public IP) The public IP address of this GSLB site. Gslb Site private IP address (Private IP) The private IP address of this GSLB site. Metric Exchange State (MEPstate) Indicates the status of the Metric Exchange Policy at this GSLB site. Persistence Exchange (PersMEP) Indicates whether Persistence entries exchange is enabled or disabled at this GSLB site. Network Metric Exchange (NwMEP)
Indicates whether network metric exchange is enabled or disabled at this GSLB site. Metric Exchange (MEP) Indicates whether metric exchange is enabled or disabled at this GSLB site. GSLB Site type (sitetype) Indicates whether this GSLB site is local or remote. Gslb Site private IP address (Private IP) The private IP address of this GSLB site. Gslb Site public IP address (Public IP) The public IP address of this GSLB site. Site Metric Metric Exchange State (SiteMetricMEPstate) Indicates the status of the site metric Metric Exchange connection at this GSLB site. Netowrk Metric Metric Exchange State (NwMetricMEPstate) Indicates the status of the network metric Metric Exchange connection at this GSLB site. Request bytes (Reqb) Total number of request bytes received by the virtual servers represented by all GSLB services associated with this GSLB site. Response bytes (Rspb) Number of response bytes received by the virtual servers represented by all GSLB services associated with this GSLB site. Requests (Req) Total number of requests received by the virtual servers represented by all GSLB services associated with this GSLB site. Responses (Rsp) Number of responses received by the virtual servers represented by all GSLB services associated with this GSLB site. Current client connections (ClntConn) Number of current client connections to the virtual servers represented by all GSLB services associated with this GSLB site. Current server connections (SvrConn) Number of current connections to the real servers behind the virtual servers represented by all GSLB services associated with this GSLB site. Example
Related Commands add gslb site rm gslb site set gslb site unset gslb site show gslb site stat gslb service stat gslb vserver stat gslb domain
add gslb service

Synopsis add gslb service <serviceName> [-cnameEntry <string> | <IP> | <serverName> | <serviceType> | <port> | -publicIP <ip_addr|ipv6_addr|*> | -publicPort <port> | -sitePersistence <sitePersistence> | -sitePrefix <string>] [-maxClient <positive_integer>] [-healthMonitor ( YES | NO )] [-siteName <string>] [-state ( ENABLED | DISABLED )] [cip ( ENABLED | DISABLED ) [<cipHeader>]] [-cookieTimeout <mins>] [-cltTimeout <secs>] [-svrTimeout <secs>] [-maxBandwidth <positive_integer>] [-downStateFlush ( ENABLED | DISABLED )] [-maxAAAUsers <positive_integer>] [-monThreshold <positive_integer>] [-hashId <positive_integer>] [-comment <string>] [appflowLog ( ENABLED | DISABLED )] Description Add a GSLB service in the system. Arguments serviceName The name of the service. cnameEntry The cname of the gslb service. IP The IP address of the server for which the service will be added serverName The name of the server for which the service will be added serviceType The type of service that is being added Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, NNTP, ANY, SIP_UDP, RADIUS, RDP, RTSP, MYSQL, MSSQL Default value: NSSVC_SERVICE_UNKNOWN port The port on which the service is running Minimum value: 1 publicIP The IP address on a NAT box in front of the system to which a private IP of the service maps. This is applicable to GSLB local services. This is optional publicPort The port on a NAT box in front of the system to which the private port of service maps. This is applicable to GSLB local services.This is optional maxClient The maximum number of open connections to the service. This argument is optional Maximum value: 4294967294 healthMonitor Health monitoring state of the gslb service. Possible values: YES, NO Default value: YES siteName The GSLB site name. This parameter is mandatory. This option specifies whether the service is a local GSLB service or remote GSLB service state The state of the service(s). This parameter is optional. This is not applicable to the local GSLB services. Possible values: ENABLED, DISABLED Default value: ENABLED cip
State of insertion of the Client IP header for the service. This parameter is used while connection proxy based Site persistency is enabled, and it inserts real client's IP address in the HTTP request Possible values: ENABLED, DISABLED Default value: DISABLED cipHeader The client IP header to be used in the HTTP request. If client IP insertion is enabled and the client IP header is not specified then the value that has been set by the set ns config CLI command will be used as the Client IP header. sitePersistence The state of cookie based Site persistency. Possible values: ConnectionProxy, HTTPRedirect, NONE cookieTimeout The timeout value in minutes for the cookie when cookie based Site persistency is enabled Maximum value: 1440 sitePrefix Specify the site prefix string. When the service is bound to a GSLB vserver, then for each bound service-domain pair, a GSLB Site domain will be generated internally by concatenating the service's siteprefix and the domain's name. If a special string "NONE" is specified, the siteprefix string will be unset cltTimeout The idle time in seconds after which the client connection is terminated. This will be used while doing site persistency Maximum value: 31536000 svrTimeout The idle time in seconds after which the server connection is terminated. This will be used while doing site persistency Maximum value: 31536000 maxBandwidth A positive integer to identify the maximum bandwidth allowed for the service downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED maxAAAUsers The maximum number of concurrent SSLVPN users allowed to login at a time. Maximum value: 65535 monThreshold The monitoring threshold. Maximum value: 65535 hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. Minimum value: 1 comment Comments associated with this gslb service. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED Example add gslb service sj_svc 203.12.123.12 http 80 -site san_jos
Related Commands rm gslb service set gslb service unset gslb service bind gslb service unbind gslb service show gslb service stat gslb service rename gslb service
rm gslb service
Synopsis rm gslb service <serviceName> Description Remove a gslb service configured in system. Arguments serviceName The name of the service entity to be removed Example rm gslb service sj_svc Related Commands add gslb service set gslb service unset gslb service bind gslb service unbind gslb service show gslb service stat gslb service rename gslb service
set gslb service

Synopsis set gslb service <serviceName> [-IPAddress <ip_addr|ipv6_addr|*>] [-publicIP <ip_addr|ipv6_addr|*>] [publicPort <port>] [-cip ( ENABLED | DISABLED ) [<cipHeader>]] [-sitePersistence <sitePersistence>] [-sitePrefix <string>] [-maxClient <positive_integer>] [-healthMonitor ( YES | NO )] [-maxBandwidth <positive_integer>] [downStateFlush ( ENABLED | DISABLED )] [-maxAAAUsers <positive_integer>] [-viewName <string> <viewIP>] [-monThreshold <positive_integer>] [-weight <positive_integer> <monitorName>] [-hashId <positive_integer>] [comment <string>] [-appflowLog ( ENABLED | DISABLED )]
Description Set parameters in the gslb service Arguments serviceName The name of the gslb service. IPAddress The new IP address of the service. publicIP The IP address on a NAT box in front of the system to which a private IP service maps. This is optional. It is only valid for LOCAL GSLB service publicPort The port on a NAT box in front of the system to which the private port of service maps. This is optional. It is only valid for local service Minimum value: 1 cip Insertion of the Client IP header for the service. This option is used while connection proxy based Site persistency is enabled Possible values: ENABLED, DISABLED Default value: DISABLED sitePersistence The state of cookie based Site persistency. Possible values: ConnectionProxy, HTTPRedirect, NONE sitePrefix The site prefix string. maxClient Maximum number of Clients. Maximum value: 4294967294 healthMonitor Health monitoring state of the gslb service. Possible values: YES, NO Default value: YES maxBandwidth Maximum bandwidth. downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED maxAAAUsers The maximum number of concurrent SSLVPN users allowed to login at a time. Maximum value: 65535 viewName The name of view for the given IP monThreshold The monitoring threshold. Maximum value: 65535 weight The weight for the specified monitor. Minimum value: 1 Maximum value: 100 hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. Minimum value: 1 comment Comments associated with this gslb service.
appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED Example set gslb service sj_svc -sitePersistence ConnectionProxy Related Commands add gslb service rm gslb service unset gslb service bind gslb service unbind gslb service show gslb service stat gslb service rename gslb service
unset gslb service

Synopsis unset gslb service <serviceName> [-publicIP] [-publicPort] [-cip] [-cipHeader] [-sitePersistence] [-sitePrefix] [maxClient] [-healthMonitor] [-maxBandwidth] [-downStateFlush] [-maxAAAUsers] [-viewIP] [-monThreshold] [monitorName] [-hashId] [-comment] [-appflowLog] Description Use this command to remove gslb service settings.Refer to the set gslb service command for meanings of the arguments. Arguments Example Related Commands add gslb service rm gslb service set gslb service bind gslb service unbind gslb service show gslb service stat gslb service rename gslb service
bind gslb service

Synopsis bind gslb service <serviceName> [-viewName <string> <viewIP>]
Description Binding a view specific IP to this service Arguments serviceName The name of the gslb service viewName The name of view for the given IP Example bind gslb service -viewName privateview 1.2.3.4 Related Commands add gslb service rm gslb service set gslb service unset gslb service unbind gslb service show gslb service stat gslb service rename gslb service
unbind gslb service

Synopsis unbind gslb service <serviceName> -viewName <string> Description Unbinding a view from the service Arguments serviceName The name of the gslb service viewName The name of view for the given IP Example unbind gslb service -viewName privateview Related Commands add gslb service rm gslb service set gslb service unset gslb service bind gslb service show gslb service stat gslb service
rename gslb service
show gslb service

Synopsis show gslb service [<serviceName>] show gslb service stats - alias for 'stat gslb service' Description Display the gslb services configured in the system. Arguments serviceName The name of the gslb service. summary fullValues format level gslb IPAddress IP address of the service serverName The name of the server for which the service will be added serviceType Service type. port Port number of the service. publicIP Public ip of the service publicPort Public port of the service maxClient Maximum number of clients. maxAAAUsers The maximum number of concurrent SSLVPN users allowed to login at a time. siteName Name of the site to which the service belongs. svrState Server state. svrEffGslbState Effective state of the gslb svc gslbthreshold Indicates if gslb svc has reached threshold gslbsvcStats Indicates if gslb svc has stats of the primary or the whole chain
state The state of the service(s). This parameter is optional. This is not applicable to the local GSLB services. monitorName Monitor name. monState State of the monitor bound to gslb service. cip Indicates if Client IP option is enabled cipHeader The client IP header used in the HTTP request. sitePersistence Indicates the type of cookie persistence set sitePrefix The site prefix string. cltTimeout Client timeout in seconds. svrTimeout Server timeout in seconds. totalfailedprobes The total number of failed probs. preferredLocation Prefered location. maxBandwidth Maximum bandwidth. downStateFlush Perform delayed clean up of connections on this vserver. cnameEntry The cname of the gslb service. viewName The name of view for the given IP viewIP IP address to be used for the given view weight The Weight of monitor monThreshold The monitoring threshold. failedprobes Number of the current failed monitoring probes. monStatCode The code indicating the monitor response. monStatParam1
First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. responseTime Response time of this monitor. monState The running state of the monitor on this service. hashId The hash identifier for the service. This must be unique for each service. This parameter is used by hash based load balancing methods. comment Comments associated with this gslb service. stateflag stateflag healthMonitor Health monitoring state of the gslb service. appflowLog Enable logging appflow flow information count Example show gslb service sj_svc Related Commands add gslb service rm gslb service set gslb service unset gslb service bind gslb service unbind gslb service stat gslb service rename gslb service
stat gslb service

Synopsis stat gslb service [<serviceName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of a service. Arguments serviceName
The name of the service. count devno stateflag Current Client Est connections (ClntEstConn) Number of client connections in ESTABLISHED state. IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running. Service type (Type) The service type of this service. State Current state of the server. Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Current load on the service (Load) Load on the service that is calculated from the bound load based monitor. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Current client connections (ClntConn) Number of current client connections. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Service hits (Hits) Number of times that the service has been provided. Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state. Example
Related Commands add gslb service rm gslb service set gslb service unset gslb service
bind gslb service unbind gslb service show gslb service rename gslb service stat gslb site stat gslb vserver stat gslb domain
rename gslb service

Synopsis rename gslb service <serviceName>@ <newName>@ Description Rename a gslb service. Arguments serviceName The name of the gslb service. newName The new name of the gslb service. Example rename gslb service gsl_svc gslb_svc_new Related Commands add gslb service rm gslb service set gslb service unset gslb service bind gslb service unbind gslb service show gslb service stat gslb service
add gslb vserver

Synopsis add gslb vserver <name> <serviceType> [-dnsRecordType <dnsRecordType>] [-lbMethod <lbMethod>] [backupLBMethod <backupLBMethod>] [-netmask <netmask>] [-v6netmasklen <positive_integer>] [-tolerance <positive_integer>] [-persistenceType ( SOURCEIP | NONE )] [-persistenceId <positive_integer>] [-persistMask <netmask>] [-v6persistmasklen <positive_integer>] [-timeout <mins>] [-EDR ( ENABLED | DISABLED )] [MIR ( ENABLED | DISABLED )] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-dynamicWeight <dynamicWeight>] [-state ( ENABLED | DISABLED )] [-considerEffectiveState ( NONE | STATE_ONLY )] [-
comment <string>] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-appflowLog ( ENABLED | DISABLED )] Description Add a GSLB vserver in the system. Arguments name The virtual server name. serviceType The service type of the virtual server Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, NNTP, ANY, SIP_UDP, RADIUS, RDP, RTSP, MYSQL, MSSQL ipType The IP type for this GSLB vserver. Possible values: IPV4, IPV6 Default value: NSGSLB_IPV4 dnsRecordType Record type for GSLB vserver. Possible values: A, AAAA, CNAME Default value: NSGSLB_A lbMethod The load balancing method for the virtual server.The valid options for this parameter are: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, SOURCEIPHASH, LEASTBANDWIDTH, LEASTPACKETS, STATICPROXIMITY, RTT , CUSTOMLOAD Possible values: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, SOURCEIPHASH, LEASTBANDWIDTH, LEASTPACKETS, STATICPROXIMITY, RTT, CUSTOMLOAD Default value: PEMGMT_LB_LEASTCONNS backupSessionTimeout A non zero value enables the feature whose minimum value is 2 minutes. The feature can be disabled by setting the value to zero. The created session is in effect for a specific client per domain. Maximum value: 1440 backupLBMethod The load balancing method for the virtual server, in case the primary lb method fails on impossible to perform. The valid options for this parameter are: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, SOURCEIPHASH, LEASTBANDWIDTH, LEASTPACKETS, STATICPROXIMITY, RTT , CUSTOMLOAD. Possible values: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, SOURCEIPHASH, LEASTBANDWIDTH, LEASTPACKETS, STATICPROXIMITY, RTT, CUSTOMLOAD netmask The netmask to be used in the SOURCEIPHASH policy. The default is 255.255.255.255 Default value: 0xFFFFFFFF v6netmasklen The Network mask. Use this parameter if you are setting the DESTINATIONIPHASH or SOURCEIPHASH policy. Enter the netmask to be used in modifying the destination or source IP address or network. Default value: 128 Minimum value: 1 Maximum value: 128 tolerance The Site selection tolerance is the maximum deviation (in milliseconds) in the RTT value, which the system can tolerate, while deciding the best site for a domain. This value enables the system to implement the Round Robin method of GSLB between sites that have RTT values within this permissible limit. The tolerance value is required only if the LB method is RTT. The default tolerance value is 0 Maximum value: 100 persistenceType The persistence type for the virtual server. This has 2 options: SOURCEIP and NONE Possible values: SOURCEIP, NONE
persistenceId The Persistence Id. This parameter is a positive integer which is used to identify the GSLB VIP on all sites. This is a required argument if SOURCEIP based persistency is enabled. Maximum value: 65535 persistMask The netmask to be used while SOURCEIP based persistency is ENABLED.This is an optional argument. Default value: 0xFFFFFFFF v6persistmasklen The persistence mask. Use this parameter if you are using IP based persistence type on a ipv6 vserver. Default value: 128 Minimum value: 1 Maximum value: 128 timeout The idle time out in minutes for the persistence entries Default value: 2 Minimum value: 2 Maximum value: 1440 EDR Use this parameter to specify whether System will send empty DNS response when all the sites participating in GSLB are down Possible values: ENABLED, DISABLED Default value: DISABLED MIR Use this parameter to specify whether System can send Multiple IP addresses in the DNS response or not. Possible values: ENABLED, DISABLED Default value: DISABLED disablePrimaryOnDown When this feature is enabled we will continue to direct traffic to the backup chain even after the primary comes UP. Ideally one should use backup persistence if they want to stick to the same vserver in the chain. Possible values: ENABLED, DISABLED Default value: DISABLED dynamicWeight Specifies whether we want to consider the svc count or the svc weights or ignore both Possible values: SERVICECOUNT, SERVICEWEIGHT, DISABLED Default value: DISABLED state State of the virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED considerEffectiveState Specifies which backup to consider when the primary state of all gslb services bound to the vip are down. By specifying NONE we will not consider the effective state of the gslb service to determine the state of the gslb vip. If STATE_ONLY is chosen we will consider the effective state obtained via MEP to determine the state of the gslb vip Possible values: NONE, STATE_ONLY Default value: NS_GSLB_DONOT_CONSIDER_BKPS comment Comments associated with this virtual server. soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The spillover persistency entry timeout. Default value: 2 Minimum value: 2 Maximum value: 1440 soThreshold
In case of CONNECTION (or) DYNAMICCONNECTION type spillover method this value is treated as Maximum number of connections a lb vserver will handle before spillover takes place. In case of BANDWIDTH type spillover method this value is treated as the amount of incoming and outgoing traffic (in Kbps) a Vserver will handle before spillover takes place. In case of HEALTH type spillover method if the percentage of active services (by weight) becomes lower than this value, spillover takes place Minimum value: 1 Maximum value: 4294967287 appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED Example add gslb vserver gvip http Related Commands rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
rm gslb vserver
Synopsis rm gslb vserver <name> Description Remove a GSLB vserver configured in system. Arguments name The name of the GSLB virtual server to be removed Example rm gslb vserver gvip Related Commands add gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver
disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
set gslb vserver

Synopsis set gslb vserver <name> [-dnsRecordType <dnsRecordType>] [-backupVServer <string>] [-lbMethod <lbMethod>] [-backupLBMethod <backupLBMethod>] [-netmask <netmask>] [-v6netmasklen <positive_integer>] [-tolerance <positive_integer>] [-persistenceType ( SOURCEIP | NONE )] [-persistenceId <positive_integer>] [-persistMask <netmask>] [-v6persistmasklen <positive_integer>] [-timeout <mins>] [-EDR ( ENABLED | DISABLED )] [MIR ( ENABLED | DISABLED )] [-disablePrimaryOnDown ( ENABLED | DISABLED )] [-dynamicWeight <dynamicWeight>] [-considerEffectiveState ( NONE | STATE_ONLY )] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [serviceName <string> -weight <positive_integer>] [-domainName <string> [-TTL <secs>] [-backupIP <ip_addr| ipv6_addr|*>] [-cookieDomain <string>] [-cookieTimeout <mins>] [-sitedomainTTL <secs>]] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] Description Specify different settings on GSLB vserver Arguments name The virtual server name. ipType The IP type for this GSLB vserver. Possible values: IPV4, IPV6 Default value: NSGSLB_IPV4 dnsRecordType Record type for GSLB vserver. Possible values: A, AAAA, CNAME Default value: NSGSLB_A backupVServer Backup server. backupSessionTimeout A non zero value enables the feature whose minimum value is 2 minutes. The feature can be disabled by setting the value to zero. The created session is in effect for a specific client per domain. Maximum value: 1440 lbMethod The load balancing method for the virtual server. Possible values: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, SOURCEIPHASH, LEASTBANDWIDTH, LEASTPACKETS, STATICPROXIMITY, RTT, CUSTOMLOAD Default value: PEMGMT_LB_LEASTCONNS netmask The netmask to be used in the SOURCEIPHASH policy. Default value: 0xFFFFFFFF v6netmasklen The Network mask. Use this parameter if you are setting the DESTINATIONIPHASH or SOURCEIPHASH policy. Enter the v6 prefix length to be used in modifying the destination or source IPv6 address or network. Default value: 128 Minimum value: 1 Maximum value: 128 tolerance The Site selectionn tolerance. Site selection tolerance is the maximum deviation (in milliseconds) in the RTT value, which the System system can tolerate, while deciding the best site for a domain.
This value enables the system to implement the Round Robin method of GSLB between sites that have RTT values within this permissible limit. The tolerance value is required only if the LB method is RTT. Maximum value: 100 persistenceType The persistence type for the virtual server. Possible values: SOURCEIP, NONE persistenceId The Persistence Id. This parameter is a positive integer which is used to identify the GSLB VIP on all sites Maximum value: 65535 persistMask The netmask to be used while SOURCEIP based persistency is ENABLED.This is an optional argument. Default is 255.255.255.255 Default value: 0xFFFFFFFF v6persistmasklen The netmask to be useed for ipv6 traffic when the persistency type is SOURCEIP. Default value: 128 Minimum value: 1 Maximum value: 128 timeout The idle time out in minutes for the persistence entries Default value: 2 Minimum value: 2 Maximum value: 1440 EDR The state of the System in sending empty DNS response when all the sites participating in GSLB are down. Possible values: ENABLED, DISABLED Default value: DISABLED MIR The state of the System in sending Multiple IP addresses in the DNS response. Possible values: ENABLED, DISABLED Default value: DISABLED disablePrimaryOnDown When this feature is enabled we will continue to direct traffic to the backup chain even after the primary comes UP. Ideally one should use backup persistence if they want to stick to the same vserver in the chain. Possible values: ENABLED, DISABLED Default value: DISABLED dynamicWeight The state to consider the svc count or the svc weights or ignore both. Possible values: SERVICECOUNT, SERVICEWEIGHT, DISABLED Default value: DISABLED considerEffectiveState Specifies which backup to consider when the primary state of all gslb services bound to the vip are down. By specifying NONE we will not consider the effective state of the gslb service to determine the state of the gslb vip. If STATE_ONLY is chosen we will consider the effective state obtained via MEP to determine the state of the gslb vip Possible values: NONE, STATE_ONLY Default value: NS_GSLB_DONOT_CONSIDER_BKPS soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The spillover persistency entry timeout. Default value: 2 Minimum value: 2 Maximum value: 1440 soThreshold
In case of CONNECTION (or) DYNAMICCONNECTION type spillover method this value is treated as Maximum number of connections a lb vserver will handle before spillover takes place. In case of BANDWIDTH type spillover method this value is treated as the amount of incoming and outgoing traffic (in Kbps) a Vserver will handle before spillover takes place. In case of HEALTH type spillover method if the percentage of active services (by weight) becomes lower than this value, spillover takes place Minimum value: 1 Maximum value: 4294967287 serviceName The service for which the weight needs to be changed. domainName The name of the domain for which TTL and/or backupIP has to be changed. comment Comments associated with this virtual server. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED Example set gslb vserver gvip -persistenceType SOURCEIP
Related Commands add gslb vserver rm gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
unset gslb vserver

Synopsis unset gslb vserver <name>@ [-backupVServer] [-dnsRecordType] [-lbMethod] [-backupLBMethod] [-netmask] [-v6netmasklen] [-tolerance] [-persistenceType] [-persistenceId] [-persistMask] [-v6persistmasklen] [-timeout] [EDR] [-MIR] [-disablePrimaryOnDown] [-dynamicWeight] [-considerEffectiveState] [-soMethod] [-soPersistence] [soPersistenceTimeOut] [-serviceName] [-weight] [-comment] [-appflowLog] Description Unset the backup virtual server or redirectURL set on the virtual server..Refer to the set gslb vserver command for meanings of the arguments.
Arguments Example unset gslb vserver lb_vip -backupVServer For multiple gslb vservers the command is: unset gslb vserver lb_vip[1-3] -backupVServer Related Commands add gslb vserver rm gslb vserver set gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
bind gslb vserver

Synopsis bind gslb vserver <name> [(-serviceName <string> [-weight <positive_integer>]) | (-domainName <string> [-TTL <secs>] [-backupIP <ip_addr|ipv6_addr|*>] [-cookieDomain <string>] [-cookieTimeout <mins>] [-sitedomainTTL <secs>])] Description Bind a domain or service to a GSLB vserver Arguments name The vserver for which the binding operation is to be done serviceName The name of the service to be bound with the gslb vserver domainName The domain to be bound with this vserver Example bind gslb vserver gvip -domainName www.mynw.com Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver unbind gslb vserver enable gslb vserver
disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
unbind gslb vserver

Synopsis unbind gslb vserver <name> [-serviceName <string> | (-domainName <string> [-backupIP] [-cookieDomain])] Description Unbind the domain or service from the gslb vserver Arguments name The vserver for which the unbinding operation is to be performed serviceName The service to be unbound from the gslb vserver domainName The domain to be unbound from this vserver Example unbind gslb vserver gvip -domainName www.mynw.com Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
enable gslb vserver

Synopsis enable gslb vserver <name>@ Description Enable a virtual server. Note: Virtual servers, when added, are enabled by default. Arguments name The name of the virtual server to be enabled.
Example enable gslb vserver gslb_vip To enable multiple gslb vservers use the following command: enable gslb vserver gslb_vip[1-3] Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver disable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
disable gslb vserver

Synopsis disable gslb vserver <name>@ Description Disable (makes out of service) a virtual server. Arguments name The name of the virtual server to be disabled. Notes: 1. The system still responds to ARP and/or ping requests for the IP address of this virtual server. 2. As the virtual server is still configured in the system, you can enable the virtual server using enable vserver CLI command. Example disable gslb vserver gslb_vip To disable multiple gslb vservers use the following command: disable gslb vserver gslb_vip[1-3] Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver show gslb vserver stat gslb vserver rename gslb vserver
show gslb vserver

Synopsis show gslb vserver [<name>] show gslb vserver stats - alias for 'stat gslb vserver' Description Display the GSLB virtual server attributes Arguments name The name of the GSLB virtual server. summary fullValues format level serviceType The service type of the virtual server ipType The IP type for this GSLB vserver. dnsRecordType The IP type for this GSLB vserver. persistenceType Indicates if persistence is set on the gslb vserver persistenceId Persistence id of the gslb vserver lbMethod The load balancing method set for the virtual server backupLBMethod Indicates the backup method in case the primary fails tolerance Indicates the deviation we can tolerate when we have the LB method as RTT timeout Idle timeout for persistence entries. state State of the gslb vserver. netmask The netmask used in the SOURCEIPHASH policy. v6netmasklen The netmask used for ipv6 traffic in the SOURCE/DEST IPHASH policy. persistMask The netmask used while SOURCEIP based persistency is ENABLED. v6persistmasklen The netmask applied for ipv6 traffic when the persistency type is SOURCEIP.
serviceName The service name. weight Weight for the service. domainName The name of the domain for which TTL and/or backupIP has changed. TTL TTL for the given domain. backupIP Backup IP for the given domain. cookieDomain cookieTimeout Time out value of the cookie in minutes sitedomainTTL Site domain TTL. IPAddress IP address. port Port number. status Current status of the gslb vserver. During the initial phase if the configured lb method is not round robin , the vserver will adopt round robin to distribute traffic for a predefined number of requests. lbrrreason Reason why a vserver is in RR. The following are the reasons: 1 - MEP is DOWN (GSLB) 2 LB method has changed 3 - Bound service's state changed to UP 4 - A new service is bound 5 Startup RR factor has changed 6 - LB feature is enabled 7 - Load monitor is not active on a service 8 - Vserver is Enabled 9 - SSL feature is Enabled 10 - All bound services have reached threshold. Using effective state to load balance (GSLB) 11 - Primary state of bound services are not UP. Using effective state to load balance (GSLB) 12 - No LB decision can be made as all bound services have either reached threshold or are not UP (GSLB) 13 - All load monitors are active preferredLocation The target site to be returned in the DNS response when a policy is successfully evaluated against the incoming DNS request. Target site is specified in dotted notation with up to 6 qualifiers. Wildcard `*' is accepted as a valid qualifier token. backupVServer Backup vserver in case the primary fails backupSessionTimeout A non zero value enables the feature. The minimum value is 2 minutes. To disable the feature set the value to zero. The created session is in effect for a specific client per domain. EDR Indicates if Empty Down Response is enabled/disabled MIR Indicates if Multi IP Response is enabled/disabled disablePrimaryOnDown
When this feature is enabled we will continue to direct traffic to the backup chain even after the primary comes UP. Ideally one should use backup persistence if they want to stick to the same vserver in the chain. dynamicWeight Dynamic weight method. Possible values are, the svc count or the svc weights or ignore both. isCname is cname feature set on vserver cumulativeWeight NSA_DYNAMIC_CONF_WT * NSA_WEIGHT dynamicConfWt Weight obtained by the virtue of bound service count or weight thresholdValue Tells whether threshold exceeded for this service participating in CUSTOMLB sitePersistence Type of Site Persistence set svrEffGslbState Effective state of the gslb svc gslbthreshold Indicates if gslb svc has reached threshold considerEffectiveState Specifies which backup to consider when the primary state of all gslb services bound to the vip are down. By specifying NONE we will not consider the effective state of the gslb service to determine the state of the gslb vip. If STATE_ONLY is chosen we will consider the effective state obtained via MEP to determine the state of the gslb vip cnameEntry The cname of the gslb service. totalServices Total number of services bound to the vserver. activeServices Total number of active services bound to the vserver. stateChangeTimeSec Time when last state change happened. Seconds part. stateChangeTimemSec Time at which last state change happened. Milliseconds part. ticksSinceLastStateChange Time in 10 millisecond ticks since the last state change. comment Comments associated with this virtual server. soPersistenceTimeOut The spillover persistency entry timeout. soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. soPersistence
The state of the spillover persistence. soThreshold In case of CONNECTION (or) DYNAMICCONNECTION type spillover method this value is treated as Maximum number of connections a lb vserver will handle before spillover takes place. In case of BANDWIDTH type spillover method this value is treated as the amount of incoming and outgoing traffic (in Kbps) a Vserver will handle before spillover takes place. In case of HEALTH type spillover method if the percentage of active services (by weight) becomes lower than this value, spillover takes place health Health of vserver based on percentage of weights of active svcs/all svcs. This does not consider administratively disabled svcs stateflag stateflag appflowLog Enable logging appflow flow information count Example show gslb vserver gvip
Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver stat gslb vserver rename gslb vserver
stat gslb vserver

Synopsis stat gslb vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of a gslb vserver. Arguments name The name of the gslb vserver for which statistics will be displayed. If not given statistics are shown for all gslb vservers.
count devno stateflag Current Client Est connections (ClntEstConn) Number of client connections in ESTABLISHED state. Vserver Health (Health) Health of the vserver. This gives percentage of UP services bound to this vserver. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Vserver hits (Hits) Total vserver hits Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Spill Over Threshold (SOThresh) Spill Over Threshold set on the VServer. Spill Over Hits (NumSo ) Number of times vserver expereinced spill over. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Current client connections (ClntConn) Number of current client connections. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state. Example
Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver
unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver rename gslb vserver stat gslb site stat gslb service stat gslb domain
rename gslb vserver

Synopsis rename gslb vserver <name>@ <newName>@ Description Rename a global load balancing virtual server. Arguments name The name of the global load balancing virtual server. newName The new name of the virtual server. Example rename gslb vserver gsl_vsvr gslb_vsvr_new Related Commands add gslb vserver rm gslb vserver set gslb vserver unset gslb vserver bind gslb vserver unbind gslb vserver enable gslb vserver disable gslb vserver show gslb vserver stat gslb vserver
add gslb policy

Synopsis
Description Add GSLB policy NOTE: This command is deprecated. Arguments name The name of the GSLB policy reqRule The expression rule action The GSLB action to be used when the reqrule is matched Example add gslb policy gslb_redirect -reqRule client_Japan -action pref_site Related Commands rm gslb policy set gslb policy show gslb policy
rm gslb policy
Synopsis Description Remove the gslb policy configured in the system NOTE: This command is deprecated. Arguments name The name of the policy to be removed Example rm gslb policy gslb_redirect Related Commands add gslb policy set gslb policy show gslb policy
set gslb policy

Synopsis Description Change the action for the given gslb policy NOTE: This command is deprecated.
Arguments name The name of the gslb policy. action The action to be taken for the given gslb policy Example set gslb policy gslb_redirect -action redirect_asia
Related Commands add gslb policy rm gslb policy show gslb policy
show gslb policy

Synopsis
Description Display the configured GSLB policy NOTE: This command is deprecated. Arguments name The name of the GSLB policy. format level reqRule The expression rule action The action taken for the given gslb policy. hits Number of policy hits for the gslb policy. count stateflag Example show gslb policy
Related Commands add gslb policy rm gslb policy set gslb policy
add gslb action

Synopsis
Description Add GSLB action used in the GSLB policy NOTE: This command is deprecated. Arguments name The name of the GSLB action preferredLocation The target site to be returned in the DNS response when a policy is successfully evaluated against the incoming DNS request. Target site is specified in dotted notation with up to 6 qualifiers. Wildcard `*' is accepted as a valid qualifier token. Example add gslb action pref_site -preferredlocation NorthAmerica.US.*.*.*.*
Related Commands rm gslb action set gslb action show gslb action
rm gslb action
Synopsis
Description Remove the gslb action configured in the system NOTE: This command is deprecated. Arguments name The name of the action to be removed Example rm gslb action redirect_asia
Related Commands add gslb action set gslb action show gslb action
set gslb action

Synopsis
Description Change the preferredlocation of the given gslb action NOTE: This command is deprecated. Arguments name The name of the GSLB action preferredLocation The target site to be returned in the DNS response when a policy is successfully evaluated against the incoming DNS request. Target site is specified in dotted notation with up to 6 qualifiers. Wildcard `*' is accepted as a valid qualifier token. Example set gslb action pref_site -preferredlocation NorthAmerica.US.*.*.*.*
Related Commands add gslb action rm gslb action show gslb action
show gslb action

Synopsis
Description Display the GSLB actions configured NOTE: This command is deprecated. Arguments name The name of the action. format level preferredLocation The target site to be returned in the DNS response when a policy is successfully evaluated against the incoming DNS request. Target site is specified in dotted notation with up to 6 qualifiers. Wildcard `*' is accepted as a valid qualifier token. count stateflag
Example show gslb action
Related Commands add gslb action rm gslb action set gslb action
show gslb runningConfig

Synopsis show gslb runningConfig Description Display the information pertaining to all the configuration that has been applied to the system, including settings that have not yet been saved to the system's ns.conf file using the save config command. Arguments response gslb sync status as text blob Example
Related Commands
stat gslb domain

Synopsis stat gslb domain [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of a gslb domain. Arguments name The name of the gslb domain for which statistics will be displayed. If not given statistics are shown for all gslb domain. count devno stateflag domainHits (Hits) Total number of DNS queries received. domainHits (Hits) Total number of DNS queries received.
Example
Related Commands stat gslb site stat gslb service stat gslb vserver
clear gslb ldnsentries

Synopsis clear gslb ldnsentries Description Use this command to clear the ldns entries. Arguments Example
Related Commands show gslb ldnsentries
show gslb ldnsentries

Synopsis show gslb ldnsentries Description Displays the LDNS entries. Arguments summary fullValues siteName The GSLB site name numsites Specifies the number of gslb sites IPAddress IP address of the LDNS server TTL TTL value of the LDNS entry name
Monitor that is currently being used to monitor the LDNS ip.. rtt RTT value of the LDNS entry for all gslb sites count stateflag Example show gslb ldnsentries
Related Commands clear gslb ldnsentries
set gslb parameter

Synopsis set gslb parameter [-ldnsEntryTimeout <secs>] [-RTTTolerance <msecs>] [-ldnsMask <netmask>] [-v6ldnsmasklen <positive_integer>] [-ldnsProbeOrder <ldnsProbeOrder> ...] [-dropLdnsReq ( ENABLED | DISABLED )] Description Set different GSLB parameters Arguments ldnsEntryTimeout The idle timeout in seconds of the learnt LDNS entry. If no new DNS request is made within this interval, then the LDNS entry is aged out. Default value: 180 Maximum value: 65534 RTTTolerance The RTT Tolerance in milli seconds. When the RTT is calculated for an LDNS entry, and if the difference between the old RTT and the newly computed one is less than or equal to the RTT Tolerance value, the network metric table is not updated with the new value for this LDNS entry. This is done to prevent exchange of metric when there is small variation in RTT. Default value: 5 Minimum value: 1 Maximum value: 100 ldnsMask The Netmask. The Netmask specified here is used to store the LDNS IP addresses in the hash table and these are used in dynamic proximity-based GSLB Default value: 0xFFFFFFFF v6ldnsmasklen The V6 ldns mask prefix length. Default value: 128 Minimum value: 1 Maximum value: 128 ldnsProbeOrder The order in which monitors should be initiated to calculate RTT. Possible values: PING, DNS, TCP Default value: ARRAY(0x98cd2d8) dropLdnsReq Drop LDNS requests if no RTT info available.Effective state will be not be considered when services are down or saturated too. Possible values: ENABLED, DISABLED Default value: DISABLED Example set gslb parameter -ldnsMask 255.255.0.0
Related Commands unset gslb parameter show gslb parameter
unset gslb parameter

Synopsis unset gslb parameter [-ldnsEntryTimeout] [-RTTTolerance] [-ldnsMask] [-v6ldnsmasklen] [-ldnsProbeOrder] [dropLdnsReq] Description Use this command to remove gslb parameter settings.Refer to the set gslb parameter command for meanings of the arguments. Arguments Example
Related Commands set gslb parameter show gslb parameter
show gslb parameter

Synopsis show gslb parameter Description Display the GSLB parameters Arguments format level flags State of the GSLB parameter. ldnsEntryTimeout The idle timeout in seconds of the learnt LDNS entry. If no new DNS request is made within this interval, then the LDNS entry is aged out. RTTTolerance The RTT Tolerance in milli seconds. When the RTT is calculated for an LDNS entry, and if the difference between the old RTT and the newly computed one is less than or equal to the RTT Tolerance value, the network metric table is not updated with the new value for this LDNS entry. This is done to prevent exchange of metric when there is small variation in RTT. ldnsMask The Netmask. The Netmask specified here is used to store the LDNS IP addresses in the hash table and these are used in dynamic proximity-based GSLB
v6ldnsmasklen The V6 ldns mask prefix length. ldnsProbeOrder The order in which monitors should be initiated to calculate RTT dropLdnsReq Drop LDNS requests if no RTT info available.Effective state will be not be considered when services are down or saturated too. Example show gslb parameter
Related Commands set gslb parameter unset gslb parameter
rm gslb ldnsentry
Synopsis rm gslb ldnsentry <IPAddress> Description Removes the LDNS entry corresponding to the IP address given Arguments IPAddress IP address of the LDNS server Example rm gslb ldnsentry 10.102.27.226
Related Commands
sync gslb config

Synopsis sync gslb config [-preview | -forceSync <string> | -nowarn | -saveconfig] [-debug] Description Synchronize the GSLB running configuration on all NetScalers participating in GSLB. The NetScaler on which this command is run is considered the "master node". All GSLB sites configured on the master, which do not have a parent, will be brought in sync with the master node. Arguments preview Preview of the commands that are applied on the slave node. This won't initiate the gslb auto sync.
debug A more verbose output of gslb auto sync. forceSync Forcibly sync the config from master to slave. The slave is identified with the sitename supplied as part of the argument. If the supplied argument is "all-sites", the config will be pushed to all slave nodes. nowarn Suppresses warning and confirmation prompt saveconfig Executes saveconfig on master prior to sync and after successful sync on slaves Example sync gslb config
Related Commands
show gslb syncStatus

Synopsis show gslb syncStatus Description Shows the status of the master and slave nodes configured for GSLB Auto Sync. Arguments response gslb sync status as text blob Example
Related Commands
Chapter
22
Ha Commands
Topics: add HA node rm HA node set HA node unset HA node bind HA node unbind HA node show HA node stat HA node force HA sync sync HA files force HA failover
608 | Citrix NetScaler 10 | Ha Commands
add HA node
Synopsis add HA node <id> <IPAddress> [-inc ( ENABLED | DISABLED )] Description Add the IP address of the other system in the high availability configuration. The IP addresses of the both the systems must belong to the same subnet. Arguments id The unique number that identifies the node. Minimum value: 1 Maximum value: 64 IPAddress The IP address of the node to be added. This should be in same subnet as NSIP. inc The state of INC mode. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands rm HA node set HA node unset HA node bind HA node unbind HA node show HA node stat HA node
rm HA node
Synopsis rm HA node <id> Description Remove a node. Arguments id The unique number that identifies the node. Maximum value: 64 Example
Related Commands add HA node set HA node
Citrix NetScaler 10 | Ha Commands | 609
unset HA node bind HA node unbind HA node show HA node stat HA node
set HA node
Synopsis set HA node [-haStatus <haStatus>] [-haSync ( ENABLED | DISABLED )] [-haProp ( ENABLED | DISABLED )] [helloInterval <msecs>] [-deadInterval <secs>] [-failSafe ( ON | OFF )] Description Set the HA status of the current node and configure synchronization. Arguments id The unique number that identifies the node. Maximum value: 64 haStatus The HA status of the node. The HA status STAYSECONDARY is used to force the secondary device stay as secondary independent of the state of the Primary device. For example, in an existing HA setup, the Primary node has to be upgraded and this process would take few seconds. During the upgradation, it is possible that the Primary node may suffer from a downtime for a few seconds. However, the Secondary should not take over as the Primary node. Thus, the Secondary node should remain as Secondary even if there is a failure in the Primary node. STAYPRIMARY configuration keeps the node in primary state in case if it is healthy, even if the peer node was the primary node initially. If the node with STAYPRIMARY setting (and no peer node) is added to a primary node (which has this node as the peer) then this node takes over as the new primary and the older node becomes secondary. ENABLED state means normal HA operation without any constraints/preferences. DISABLED state disables the normal HA operation of the node. Possible values: ENABLED, STAYSECONDARY, DISABLED, STAYPRIMARY haSync The state of synchronization. Possible values: ENABLED, DISABLED Default value: ENABLED haProp The state of propagation. The valid values are Enabled and Disabled. Possible values: ENABLED, DISABLED Default value: ENABLED helloInterval The Hello Interval in milliseconds.This interval is the duration after which HA heartbeats are sent to the peer node. Default value: 200 Minimum value: 200 Maximum value: 1000 deadInterval The Dead Interval in seconds.This interval is the minimum time during which if no HA heartbeats are received from the peer, it is assumed that the peer node is down. Default value: 3 Minimum value: 3 Maximum value: 60 failSafe The HA fail safe mode. If enabled then it allows a node to be primary even if both the nodes are unhealthy. Possible values: ON, OFF Default value: OFF Example
Related Commands add HA node rm HA node unset HA node bind HA node unbind HA node show HA node stat HA node
unset HA node
Synopsis unset HA node [-haStatus] [-haSync] [-haProp] [-helloInterval] [-deadInterval] [-failSafe] Description Use this command to remove HA node settings.Refer to the set HA node command for meanings of the arguments. Arguments Example
Related Commands add HA node rm HA node set HA node bind HA node unbind HA node show HA node stat HA node
bind HA node
Synopsis bind HA node [<id>] (-routeMonitor <ip_addr|ipv6_addr|*> [<netmask>]) Description Monitor the presence of a route in the FIB. Arguments id The unique number that identifies the node. Maximum value: 64 routeMonitor
Route Monitor Example
Related Commands add HA node rm HA node set HA node unset HA node unbind HA node show HA node stat HA node
unbind HA node
Synopsis unbind HA node [<id>] (-routeMonitor <ip_addr|ipv6_addr|*> [<netmask>]) Description Unbind a route monitor from the node. Arguments id The unique number that identifies the node. Maximum value: 64 routeMonitor Route monitor. Example
Related Commands add HA node rm HA node set HA node unset HA node bind HA node show HA node stat HA node
show HA node
Synopsis show HA node [<id>]
Description Display all nodes. It also displays the number of additional nodes, ID, IP address, and the state of all nodes. Arguments id Node id. Maximum value: 64 summary fullValues format level name Node Name. IPAddress IP Address of the node. flags The flags for this entry. stateflag haStatus HA status. state HA Master State. haSync HA Sync State. haProp HA Propagation Status. enaifaces Enabled interfaces. disifaces Disabled interfaces. hamonifaces HAMON ON interfaces. pfifaces Interfaces causing Partial Failure. ifaces Interfaces on which non-multicast is not seen. network The network. netmask The netmask. inc INC state. ssl2
SSL card status. helloInterval Hello Interval. deadInterval Dead Interval. masterStateTime Time elapsed in current master state failSafe The HA fail safe mode. If enabled then it allows a node to be primary even if both the nodes are unhealthy. routeMonitor The IP address (IPv4 or IPv6). count Example An example of the command's output is as follows: 2 configured nodes: 1) Node ID: 0 IP: 192.168.100.5 Primary node 2) Node ID: 2 IP: 192.168.100.112 Secondary node Related Commands add HA node rm HA node set HA node unset HA node bind HA node unbind HA node stat HA node
stat HA node
Synopsis stat HA node [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display high-availability protocol statistics. Arguments High Availability (HA) Whether a NetScaler appliance is configured for high availability. Possible values are YES and NO. If the value is NO, the high availability statistics below are invalid. System state (HAState) State of the HA node, based on its health, in a high availability setup. Possible values are: UP - Indicates that the node is accessible and can function as either a primary or secondary node. DISABLED - Indicates that the high availability status of the node has been manually disabled. Synchronization and propagation cannot take place between the peer nodes. INIT - Indicates that the node is in the process of becoming part of the high availability configuration. PARTIALFAIL - Indicates that one of the high availability monitored interfaces has failed because of a card or link failure. This state triggers a failover. COMPLETEFAIL - Indicates that all the interfaces of the
node are unusable, because the interfaces on which high availability monitoring is enabled are not connected or are manually disabled. This state triggers a failover. DUMB - Indicates that the node is in listening mode. It does not participate in high availability transitions or transfer configuration from the peer node. This is a configured value, not a statistic. PARTIALFAILSSL - Indicates that the SSL card has failed. This state triggers a failover. ROUTEMONITORFAIL - Indicates that the route monitor has failed. This state triggers a failover. Master state (mastate) Indicates the high availability state of the node. Possible values are: STAYSECONDARY Indicates that the selected node remains the secondary node in a high availability setup. In this case a forced failover does not change the state but, instead, returns an appropriate error message. This is a configured value and not a statistic. PRIMARY - Indicates that the selected node is the primary node in a high availability setup. SECONDARY - Indicates that the selected node is the secondary node in a high availability setup. CLAIMING - Indicates that the secondary node is in the process of taking over as the primary node. This is the intermediate state in the transition of the secondary node to primary status. FORCE CHANGE - Indicates that the secondary node is forcibly changing its status to primary due to a forced failover issued on the secondary node. Last Transition time (TransTime) Time when the last master state transition occurred. You can use this statistic for debugging. Heartbeats received (HApktrx) Number of heartbeat packets received from the peer node. Heartbeats are sent at regular intervals (default is 200 milliseconds) to determine the state of the peer node. Heartbeats sent (HApkttx) Number of heartbeat packets sent to the peer node. Heartbeats are sent at regular intervals (default is 200 milliseconds) to determine the state of the peer node. Propagation timeouts (ptimeout) Number of times propagation timed out. Sync failure (syncfail) Number of times the configuration of the primary and secondary nodes failed to synchronize since that last transition. A synchronization failure results in mismatched configuration. It can be caused by a mismatch in the Remote Procedural Call (RPC) password on the two nodes forming the high availability pair. Example
Related Commands add HA node rm HA node set HA node unset HA node bind HA node unbind HA node show HA node
force HA sync
Synopsis force HA sync [-force [-save ( YES | NO )]]
Description Force the configuration to be synchronized between the HA pair. Arguments force Initiate force sync irrespective of haprop/hasync states save Save/NoSave option for config after sync, without prompts Possible values: YES, NO Default value: VAL_NOT_SET Example Can be used in following formats: >force sync <cr> >force sync -force <cr> >force sync -force save [yes|no]<cr>
Related Commands
sync HA files
Synopsis sync HA files [<Mode> ...] Description Synchronize SSL Certificates, SSL CRL lists, and SSL VPN bookmarks from the primary node to the secondary node in a high-availability pair. The node in primary state is always considered authoritative. Files are copied from primary to secondary (but files are not deleted from the secondary even if they are not present in the primary), even when the command is invoked from a node in secondary state. The sync command supports six modes; all, bookmarks, ssl, imports, misc and all_plus_misc (This mode is similar to all but includes rc.conf and license files also). The following paths correspond to the synchronization mode: Mode Paths all /nsconfig/ssl/ /var/netscaler/ ssl/ /var/vpn/bookmarks/ /nsconfig/htmlinjection/ /nsconfig/monitors/ /nsconfig/syslog.conf /nsconfig/nstemplates/ / nsconfig/resolv.conf /nsconfig/rc.netscaler /nsconfig/inetd.conf /nsconfig/sshd_config /nsconfig/hosts /nsconfig/ snmpd.conf /nsconfig/ntp.conf /nsconfig/enckey /nsconfig/httpd.conf /etc/krb5.conf /etc/krb5.keytab /var/lib/likewise/ db/ /nsconfig/ssh/ ssl /nsconfig/ssl/ /var/netscaler/ssl/ bookmarks /var/vpn/bookmark/ htmlinjection /nsconfig/ htmlinjection/ imports /var/download/ misc /nsconfig/license/ /nsconfig/rc.conf all_plus_misc Includes *all* files and /nsconfig/rc.conf, /nsconfig/license/ Arguments Mode The sync mode. Example sync files all
Related Commands
force HA failover
Synopsis force HA failover [-force]
Description Trigger a failover. Arguments force Initiate force failover without confirmation. Example
Related Commands
Chapter
23
Ha Commands
Topics: add HA node rm HA node set HA node unset HA node bind HA node unbind HA node show HA node stat HA node force HA sync sync HA files force HA failover
add HA node
Synopsis add HA node <id> <IPAddress> [-inc ( ENABLED | DISABLED )] Description Add the IP address of the other system in the high availability configuration. The IP addresses of the both the systems must belong to the same subnet. Arguments id The unique number that identifies the node. Minimum value: 1 Maximum value: 64 IPAddress The IP address of the node to be added. This should be in same subnet as NSIP. inc The state of INC mode. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands rm HA node set HA node unset HA node bind HA node unbind HA node show HA node stat HA node
rm HA node
Synopsis rm HA node <id> Description Remove a node. Arguments id The unique number that identifies the node. Maximum value: 64 Example
Related Commands add HA node set HA node
unset HA node bind HA node unbind HA node show HA node stat HA node
set HA node
Synopsis set HA node [-haStatus <haStatus>] [-haSync ( ENABLED | DISABLED )] [-haProp ( ENABLED | DISABLED )] [helloInterval <msecs>] [-deadInterval <secs>] [-failSafe ( ON | OFF )] Description Set the HA status of the current node and configure synchronization. Arguments id The unique number that identifies the node. Maximum value: 64 haStatus The HA status of the node. The HA status STAYSECONDARY is used to force the secondary device stay as secondary independent of the state of the Primary device. For example, in an existing HA setup, the Primary node has to be upgraded and this process would take few seconds. During the upgradation, it is possible that the Primary node may suffer from a downtime for a few seconds. However, the Secondary should not take over as the Primary node. Thus, the Secondary node should remain as Secondary even if there is a failure in the Primary node. STAYPRIMARY configuration keeps the node in primary state in case if it is healthy, even if the peer node was the primary node initially. If the node with STAYPRIMARY setting (and no peer node) is added to a primary node (which has this node as the peer) then this node takes over as the new primary and the older node becomes secondary. ENABLED state means normal HA operation without any constraints/preferences. DISABLED state disables the normal HA operation of the node. Possible values: ENABLED, STAYSECONDARY, DISABLED, STAYPRIMARY haSync The state of synchronization. Possible values: ENABLED, DISABLED Default value: ENABLED haProp The state of propagation. The valid values are Enabled and Disabled. Possible values: ENABLED, DISABLED Default value: ENABLED helloInterval The Hello Interval in milliseconds.This interval is the duration after which HA heartbeats are sent to the peer node. Default value: 200 Minimum value: 200 Maximum value: 1000 deadInterval The Dead Interval in seconds.This interval is the minimum time during which if no HA heartbeats are received from the peer, it is assumed that the peer node is down. Default value: 3 Minimum value: 3 Maximum value: 60 failSafe The HA fail safe mode. If enabled then it allows a node to be primary even if both the nodes are unhealthy. Possible values: ON, OFF Default value: OFF Example
Related Commands add HA node rm HA node unset HA node bind HA node unbind HA node show HA node stat HA node
unset HA node
Synopsis unset HA node [-haStatus] [-haSync] [-haProp] [-helloInterval] [-deadInterval] [-failSafe] Description Use this command to remove HA node settings.Refer to the set HA node command for meanings of the arguments. Arguments Example
Related Commands add HA node rm HA node set HA node bind HA node unbind HA node show HA node stat HA node
bind HA node
Synopsis bind HA node [<id>] (-routeMonitor <ip_addr|ipv6_addr|*> [<netmask>]) Description Monitor the presence of a route in the FIB. Arguments id The unique number that identifies the node. Maximum value: 64 routeMonitor
Route Monitor Example
Related Commands add HA node rm HA node set HA node unset HA node unbind HA node show HA node stat HA node
unbind HA node
Synopsis unbind HA node [<id>] (-routeMonitor <ip_addr|ipv6_addr|*> [<netmask>]) Description Unbind a route monitor from the node. Arguments id The unique number that identifies the node. Maximum value: 64 routeMonitor Route monitor. Example
Related Commands add HA node rm HA node set HA node unset HA node bind HA node show HA node stat HA node
show HA node
Synopsis show HA node [<id>]
Description Display all nodes. It also displays the number of additional nodes, ID, IP address, and the state of all nodes. Arguments id Node id. Maximum value: 64 summary fullValues format level name Node Name. IPAddress IP Address of the node. flags The flags for this entry. stateflag haStatus HA status. state HA Master State. haSync HA Sync State. haProp HA Propagation Status. enaifaces Enabled interfaces. disifaces Disabled interfaces. hamonifaces HAMON ON interfaces. pfifaces Interfaces causing Partial Failure. ifaces Interfaces on which non-multicast is not seen. network The network. netmask The netmask. inc INC state. ssl2
SSL card status. helloInterval Hello Interval. deadInterval Dead Interval. masterStateTime Time elapsed in current master state failSafe The HA fail safe mode. If enabled then it allows a node to be primary even if both the nodes are unhealthy. routeMonitor The IP address (IPv4 or IPv6). count Example An example of the command's output is as follows: 2 configured nodes: 1) Node ID: 0 IP: 192.168.100.5 Primary node 2) Node ID: 2 IP: 192.168.100.112 Secondary node Related Commands add HA node rm HA node set HA node unset HA node bind HA node unbind HA node stat HA node
stat HA node
Synopsis stat HA node [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display high-availability protocol statistics. Arguments High Availability (HA) Whether a NetScaler appliance is configured for high availability. Possible values are YES and NO. If the value is NO, the high availability statistics below are invalid. System state (HAState) State of the HA node, based on its health, in a high availability setup. Possible values are: UP - Indicates that the node is accessible and can function as either a primary or secondary node. DISABLED - Indicates that the high availability status of the node has been manually disabled. Synchronization and propagation cannot take place between the peer nodes. INIT - Indicates that the node is in the process of becoming part of the high availability configuration. PARTIALFAIL - Indicates that one of the high availability monitored interfaces has failed because of a card or link failure. This state triggers a failover. COMPLETEFAIL - Indicates that all the interfaces of the
node are unusable, because the interfaces on which high availability monitoring is enabled are not connected or are manually disabled. This state triggers a failover. DUMB - Indicates that the node is in listening mode. It does not participate in high availability transitions or transfer configuration from the peer node. This is a configured value, not a statistic. PARTIALFAILSSL - Indicates that the SSL card has failed. This state triggers a failover. ROUTEMONITORFAIL - Indicates that the route monitor has failed. This state triggers a failover. Master state (mastate) Indicates the high availability state of the node. Possible values are: STAYSECONDARY Indicates that the selected node remains the secondary node in a high availability setup. In this case a forced failover does not change the state but, instead, returns an appropriate error message. This is a configured value and not a statistic. PRIMARY - Indicates that the selected node is the primary node in a high availability setup. SECONDARY - Indicates that the selected node is the secondary node in a high availability setup. CLAIMING - Indicates that the secondary node is in the process of taking over as the primary node. This is the intermediate state in the transition of the secondary node to primary status. FORCE CHANGE - Indicates that the secondary node is forcibly changing its status to primary due to a forced failover issued on the secondary node. Last Transition time (TransTime) Time when the last master state transition occurred. You can use this statistic for debugging. Heartbeats received (HApktrx) Number of heartbeat packets received from the peer node. Heartbeats are sent at regular intervals (default is 200 milliseconds) to determine the state of the peer node. Heartbeats sent (HApkttx) Number of heartbeat packets sent to the peer node. Heartbeats are sent at regular intervals (default is 200 milliseconds) to determine the state of the peer node. Propagation timeouts (ptimeout) Number of times propagation timed out. Sync failure (syncfail) Number of times the configuration of the primary and secondary nodes failed to synchronize since that last transition. A synchronization failure results in mismatched configuration. It can be caused by a mismatch in the Remote Procedural Call (RPC) password on the two nodes forming the high availability pair. Example
Related Commands add HA node rm HA node set HA node unset HA node bind HA node unbind HA node show HA node
force HA sync
Synopsis force HA sync [-force [-save ( YES | NO )]]
Description Force the configuration to be synchronized between the HA pair. Arguments force Initiate force sync irrespective of haprop/hasync states save Save/NoSave option for config after sync, without prompts Possible values: YES, NO Default value: VAL_NOT_SET Example Can be used in following formats: >force sync <cr> >force sync -force <cr> >force sync -force save [yes|no]<cr>
Related Commands
sync HA files
Synopsis sync HA files [<Mode> ...] Description Synchronize SSL Certificates, SSL CRL lists, and SSL VPN bookmarks from the primary node to the secondary node in a high-availability pair. The node in primary state is always considered authoritative. Files are copied from primary to secondary (but files are not deleted from the secondary even if they are not present in the primary), even when the command is invoked from a node in secondary state. The sync command supports six modes; all, bookmarks, ssl, imports, misc and all_plus_misc (This mode is similar to all but includes rc.conf and license files also). The following paths correspond to the synchronization mode: Mode Paths all /nsconfig/ssl/ /var/netscaler/ ssl/ /var/vpn/bookmarks/ /nsconfig/htmlinjection/ /nsconfig/monitors/ /nsconfig/syslog.conf /nsconfig/nstemplates/ / nsconfig/resolv.conf /nsconfig/rc.netscaler /nsconfig/inetd.conf /nsconfig/sshd_config /nsconfig/hosts /nsconfig/ snmpd.conf /nsconfig/ntp.conf /nsconfig/enckey /nsconfig/httpd.conf /etc/krb5.conf /etc/krb5.keytab /var/lib/likewise/ db/ /nsconfig/ssh/ ssl /nsconfig/ssl/ /var/netscaler/ssl/ bookmarks /var/vpn/bookmark/ htmlinjection /nsconfig/ htmlinjection/ imports /var/download/ misc /nsconfig/license/ /nsconfig/rc.conf all_plus_misc Includes *all* files and /nsconfig/rc.conf, /nsconfig/license/ Arguments Mode The sync mode. Example sync files all
Related Commands
force HA failover
Synopsis force HA failover [-force]
Description Trigger a failover. Arguments force Initiate force failover without confirmation. Example
Related Commands
Chapter
24
Ipsec Commands
Topics: add ipsec peer show ipsec peer rm ipsec peer set ipsec parameter unset ipsec parameter show ipsec parameter stat ipsec counters
628 | Citrix NetScaler 10 | Ipsec Commands
add ipsec peer

Synopsis add ipsec peer <name> <localIP> <peerIP> [-encAlgo ( AES | 3DES ) ...] [-hashAlgo <hashAlgo> ...] [lifetime <positive_integer>] (-psk | (-publickey <string> -privatekey <string> -peerPublicKey <string>)) [livenessCheckInterval <positive_integer>] [-retransmissiontime <positive_integer>] Description Add an ipsec peer. Arguments name The name of the ipsec peer localIP Local IP address to be used for SA peerIP The IP address of the ipsec peer encAlgo Type of encryption algorithm hashAlgo Type of hashing algorithm lifetime Lifetime of SA in seconds Minimum value: 1 Maximum value: 31536000 psk Pre shared key value publickey Public key file path livenessCheckInterval Number of seconds after which a notify payload is sent to check the liveliness of the peer. Additional retries are done as per retransmit interval setting. Zero value disables liveliness checks. Maximum value: 64999 retransmissiontime The interval in seconds to retry sending the IKE messages to peer, three consecutive attempts are done with doubled interval after every failure. Minimum value: 1 Maximum value: 99 Example Related Commands show ipsec peer rm ipsec peer
show ipsec peer

Synopsis show ipsec peer [<name>] Description Display all of the configured ipsec peeers
Citrix NetScaler 10 | Ipsec Commands | 629
Arguments name The name of the ipsec peer summary fullValues format level localIP Local IP address to be used for SA peerIP The IP address of the ipsec peer encAlgo Type of encryption algorithm. hashAlgo Type of hashing algorithm lifetime Lifetime of SA in seconds livenessCheckInterval Number of seconds after which a notify payload is sent to check the liveliness of the peer. Additional retries are done as per retransmit interval setting. Zero value disables liveliness checks. retransmissiontime The interval in seconds to retry sending the IKE messages to peer, three consecutive attempts are done with doubled interval after every failure. psk Pre shared key value publickey Public key file path privatekey Private key file path peerPublicKey Peer public key file path ipsecTunnelStatus Whether the tunnel is up or down. count stateflag Example show ipsec peer Related Commands add ipsec peer rm ipsec peer
rm ipsec peer
Synopsis rm ipsec peer <name> Description Remove an ipsec peeer Arguments name The name of the ipsec peer. Example rm ipsec peer
Related Commands add ipsec peer show ipsec peer
set ipsec parameter

Synopsis set ipsec parameter [-encAlgo ( AES | 3DES ) ...] [-hashAlgo <hashAlgo> ...] [-lifetime <positive_integer>] [livenessCheckInterval <positive_integer>] [-retransmissiontime <positive_integer>] Description Set global parameters for IPSEC Arguments encAlgo Type of encryption algorithm Default value: ENC_AES hashAlgo Type of hashing algorithm Default value: HMAC_SHA256 lifetime Lifetime of SA in seconds Minimum value: 1 Maximum value: 31536000 livenessCheckInterval Number of seconds after which a notify payload is sent to check the liveliness of the peer. Additional retries are done as per retransmit interval setting. Zero value disables liveliness checks. Maximum value: 64999 retransmissiontime The interval in seconds to retry sending the IKE messages to peer, three consecutive attempts are done with doubled interval after every failure., increases for every retransmit till 6 retransmits. Minimum value: 1 Maximum value: 99 Example
Citrix NetScaler 10 | Ipsec Commands | 631
Related Commands unset ipsec parameter show ipsec parameter
unset ipsec parameter

Synopsis unset ipsec parameter [-encAlgo] [-hashAlgo] [-lifetime] [-livenessCheckInterval] [-retransmissiontime] Description Set global parameters for IPSEC.Refer to the set ipsec parameter command for meanings of the arguments. Arguments Example
Related Commands set ipsec parameter show ipsec parameter
show ipsec parameter

Synopsis show ipsec parameter Description Show global parameters for IPSEC Arguments summary fullValues format level encAlgo Type of encryption algorithm hashAlgo Type of hashing algorithm lifetime Lifetime of SA in seconds livenessCheckInterval Number of seconds after which a notify payload is sent to check the liveliness of the peer. Additional retries are done as per retransmit interval setting. Zero value disables liveliness checks. retransmissiontime
The interval in seconds to retry sending the IKE messages to peer, three consecutive attempts are done with doubled interval after every failure., increases for every retransmit till 6 retransmits. Example
Related Commands set ipsec parameter unset ipsec parameter
stat ipsec counters

Synopsis stat ipsec counters [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics for secure tunnel sessions. Arguments Bytes Received (ipsecRxBytes) Bytes received during IPsec sessions. Bytes Sent (ipsecTxBytes) Bytes sent during IPsec sessions. Packets Received (ipsecRxPkts) Packets received during IPsec sessions. Packets Sent (ipsecTxPkts) Packets sent during IPsec sessions. Example stat ipsec
Related Commands
Chapter
25
Lb Commands
Topics: add lb monitor rm lb monitor set lb monitor unset lb monitor enable lb monitor disable lb monitor bind lb monitor unbind lb monitor show lb monitor add lb route rm lb route show lb route add lb route6 rm lb route6 show lb route6 add lb vserver rm lb vserver set lb vserver unset lb vserver bind lb vserver unbind lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver rename lb vserver add lb metricTable rm lb metricTable set lb metricTable bind lb metricTable unbind lb metricTable show lb metricTable add lb wlm rm lb wlm set lb wlm unset lb wlm
634 | Citrix NetScaler 10 | Lb Commands
show lb wlm bind lb wlm unbind lb wlm show lb monbindings show lb persistentSessions clear lb persistentSessions set lb group unset lb group bind lb group unbind lb group show lb group rename lb group set lb sipParameters unset lb sipParameters show lb sipParameters set lb parameter unset lb parameter show lb parameter
Citrix NetScaler 10 | Lb Commands | 635
add lb monitor
Synopsis add lb monitor <monitorName> <type> [-action <action>] [-respCode <int[-int]> ...] [-httpRequest <string>] [rtspRequest <string>] [-customHeaders <string>] [-maxForwards <positive_integer>] [-sipMethod <sipMethod>] [-sipURI <string>] [-sipregURI <string>] [-send <string>] [-recv <string>] [-query <string>] [-queryType <queryType>] [-scriptName <string>] [-scriptArgs <string>] [-dispatcherIP <ip_addr>] [-dispatcherPort <port>] [-userName <string>] {-password } {-secondaryPassword } [-logonpointName <string>] [-lasVersion <string>] {-radKey } [-radNASid <string>] [-radNASip <ip_addr>] [-LRTM ( ENABLED | DISABLED )] [-deviation <positive_integer> [<units>]] [-interval <integer> [<units>]] [-resptimeout <integer> [<units>]] [-resptimeoutThresh <positive_integer>] [-retries <integer>] [-failureRetries <integer>] [-alertRetries <integer>] [-successRetries <integer>] [-downTime <integer> [<units>]] [-destIP <ip_addr|ipv6_addr>] [-destPort <port>] [-state ( ENABLED | DISABLED )] [-reverse ( YES | NO )] [-transparent ( YES | NO )] [-ipTunnel ( YES | NO )] [-tos ( YES | NO )] [-tosId <positive_integer>] [-secure ( YES | NO )] [-validateCred ( YES | NO )] [-domain <string>] [IPAddress <ip_addr|ipv6_addr|*> ...] [-group <string>] [-fileName <string>] [-baseDN <string>] [-bindDN <string>] [-filter <string>] [-attribute <string>] [-database <string>] [-sqlQuery <text>] [-evalRule <expression>] [mssqlProtocolVersion <mssqlProtocolVersion>] [-snmpOID <string>] [-snmpCommunity <string>] [-snmpThreshold <string>] [-snmpVersion ( V1 | V2 )] [-metricTable <string>] [-application <string>] [-sitePath <string>] [-netProfile <string>] Description Add a monitor to the system. Arguments monitorName The name of the monitor. type The type of monitor. Possible values: PING, TCP, HTTP, TCP-ECV, HTTP-ECV, UDP-ECV, DNS, FTP, LDNS-PING, LDNS-TCP, LDNS-DNS, RADIUS, USER, HTTP-INLINE, SIP-UDP, LOAD, FTP-EXTENDED, SMTP, SNMP, NNTP, MYSQL, MYSQL-ECV, MSSQL-ECV, LDAP, POP3, CITRIX-XML-SERVICE, CITRIX-WEB-INTERFACE, DNS-TCP, RTSP, ARP, CITRIXAG, CITRIX-AAC-LOGINPAGE, CITRIX-AAC-LAS, CITRIX-XD-DDC, ND6, CITRIX-WIEXTENDED action The action to be taken in INLINE monitors. Possible values: NONE, LOG, DOWN Default value: SM_DOWN respCode The response codes. For the probe to succeed, the HTTP/RADIUS response from the server must be of one of the types specified. httpRequest The HTTP request that is sent to the server (for example, "HEAD /file.html"). rtspRequest The RTSP request that is sent to the server (for example, "OPTIONS *"). customHeaders The custom header string, attached to the monitoring probes. maxForwards SIP packet max-forwards Default value: 1 Maximum value: 255 sipMethod SIP method to be used for the query Possible values: OPTIONS, INVITE, REGISTER sipURI
SIP method string, sent to the server. For example "OPTIONS sip:sip.test". sipregURI SIP user to be registered send The string that is sent to the service. Applicable to TCP-ECV, HTTP-ECV, and UDP-ECV monitor types. recv The string that is expected from the server to mark the server as UP. Applicable to TCP-ECV, HTTP-ECV, and UDP-ECV monitor types. query The DNS query (domain name) sent to the DNS service that is being monitored. queryType The type of DNS query that is sent. Possible values: Address, Zone, AAAA scriptName The path and name of the script to execute. scriptArgs The string that are put in the POST data - they are copied to the request verbatim. dispatcherIP The IP Address of the dispatcher to which the probe is sent. dispatcherPort The port of the dispatcher to which the probe is sent. userName Username on the RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/MSSQL/POP3/CITRIX-AG/ CITRIX-XD-DDC/CITRIX-WI-EXTENDED server. This user name is used in the probe. password Password used in RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/POP3/LDAP/CITRIX-AG/ CITRIX-XD-DDC/CITRIX-WI-EXTENDED server monitoring. secondaryPassword Secondary password used in Citrix Access Gateway server monitoring. logonpointName Logonpoint name used in Citrix AAC login page and logon agent service monitoring. lasVersion The version of the Citrix AAC logon agent service required by CITRIX-AAC-LAS monitor. radKey The radius key. radNASid The NAS ID to be used in Radius monitoring. radNASip The NAS IP to be used in Radius monitoring. LRTM The state of response time calculation of probes. Possible values: ENABLED, DISABLED deviation
Deviation from the learnt response time for Dynamic Response Time monitoring. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes. Maximum value: 20939000 interval The frequency at which the probe is sent to a service.The interval should be greater than the response timeout. The minimum value is 20 msec.The maximum value is 20940000 in milliseconds , 20940 in seconds and 349 in minutes Default value: 5 Minimum value: 1 Maximum value: 20940000 resptimeout The interval for which the system waits before it marks the probe as FAILED. The response timeout should be less than the value specified in -interval parameter. The UDP-ECV monitor type does not decide the probe failure by the response timeout. System considers the probe successful for UDP-ECV monitor type, when the server response matches the criteria set by the -send and -recv options or if the response is not received from the server (unless the -reverse option is set to yes). Note: The -send option specifies what data is to be sent to the server in the probe and -recv specifies the server response criteria for the probe to succeed. The probe failure is caused by the ICMP port unreachable error from the service. The minimum value is 10 msec. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes Default value: 2 Minimum value: 1 Maximum value: 20939000 resptimeoutThresh Monitor response timeout threshold , a trap will be sent if the response time for the monitoring probes exceeds the thereshold. It is given in percentage. Maximum value: 100 retries The maximum number of most recent probes considered to decide whether to mark the service as DOWN. Minimum value of retries is 1. Default value: 3 Minimum value: 1 Maximum value: 127 failureRetries The number of failed probes out of most recent "retries" number of probes required to mark the service as DOWN. By default, the system requires "retries" number of consecutive probe failures to mark the service as DOWN. Maximum value: 32 alertRetries The number of probes failures after which the system generates a snmp trap. Maximum value: 32 successRetries The number of consecutive sucessful probes required to mark the service as UP. Default value: 1 Minimum value: 1 Maximum value: 32 downTime The duration for which the system waits to make the next probe once the service is marked as DOWN. The minimum value is 10 msec. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes Default value: 30 Minimum value: 1 Maximum value: 20939000 destIP The IP address to which the probe is sent. If the destination IP address is set to 0, the destination IP address is that of the server to which the monitor is bound. destPort The TCP/UDP port to which the probe is sent. If the destination port is set to 0, the destination port is of the service to which the monitor is bound. For a USER monitor, however, this will be the port sent in the HTTP request to the dispatcher. This option is ignored if the monitor is of the PING type. state The state of the monitor. If the monitor is disabled, this monitor-type probe is not sent for all services. If the monitor is bound, the state of this monitor is not taken into account when the service of this state is determined. Possible values: ENABLED, DISABLED Default value: ENABLED
reverse The state of reverse probe's criterion check. Possible values: YES, NO Default value: NO transparent The state of the monitor for transparent devices, such as firewalls, based on the responsiveness of the services behind them. If the monitoring of transparent devices is enabled, the destination IP address should be specified. The probe is sent to the specified destination IP address using the MAC address of the transparent device. Possible values: YES, NO Default value: NO ipTunnel The state of the monitor for tunneled devices. If the monitoring of tunneled devices is enabled, the destination IP address should be specified. The probe is sent to the specified destination IP address by tunneling it to the device. Possible values: YES, NO Default value: NO tos If enabled, the probe is sent to the service by encoding the specified destination IP address in the IP TOS (6)bits. Possible values: YES, NO tosId Use this parameter to specify the TOS ID of the specified destination IP. Applicable only when the tos is enabled Minimum value: 1 Maximum value: 63 secure The state of the secure monitoring of services. SSL handshake will be done on the TCP connection established. Applicable only for TCP based monitors. This option can't be used in conjuction with CITRIX-AG monitor as this monitor is a secure monitor by default. Possible values: YES, NO Default value: NO validateCred Setting this field causes the monitor to send probe which validate the credentials of the Xen Desktop DDC. Possible values: YES, NO Default value: NO domain Domain name required by the monitors. This is for the Xen Desktop DDC monitor to validate the credentials and CITRIX-WI-EXTENDED monitor for logon process. IPAddress List of IP address to be checked against the response to the DNS monitoring probe. Applicable only to the DNS monitors. group Group name to be queried for NNTP monitor. fileName File name to be used for FTP-EXTENDED monitor. baseDN Base name for the LDAP monitor. bindDN BDN name for the LDAP monitor. filter Filter for the LDAP monitor. attribute Attribute for the LDAP monitor. database Database to be used for the MYSQL/MSSQL monitor.
sqlQuery SQL query to be used for the MYSQL/MSSQL monitor. evalRule Rule evaluated to determine the state of MYSQL/MSSQL monitor. mssqlProtocolVersion Protocol Version used by MSSQL monitor Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_70 snmpOID OID to be used for the SNMP monitor. snmpCommunity Community to be used for the SNMP monitor. snmpThreshold Threshold to be used for the SNMP monitor. snmpVersion SNMP version to be used for LOAD monitoring. Possible values: V1, V2 metricTable Metric table to use for the metrics that are going to be bound. application Name of the application that has to be executed to check the state of the service sitePath URL of the logon page. To get the dynamic page under sitepath, this sitepath must be specified ending with "/". netProfile The name of the network profile. Example add monitor http_mon http Related Commands rm lb monitor set lb monitor unset lb monitor enable lb monitor disable lb monitor show lb monitor
rm lb monitor
Synopsis rm lb monitor <monitorName> <type> [-respCode <int[-int]> ...] Description Remove either a specified monitor or response code for the HTTP monitor. While the response codes for a specified monitor are removed, the monitor itself is not removed. Built-in monitors can not be removed. Arguments monitorName
The name of the monitor. type The type of monitor. Possible values: PING, TCP, HTTP, TCP-ECV, HTTP-ECV, UDP-ECV, DNS, FTP, LDNS-PING, LDNS-TCP, LDNS-DNS, RADIUS, USER, HTTP-INLINE, SIP-UDP, LOAD, FTP-EXTENDED, SMTP, SNMP, NNTP, MYSQL, MYSQL-ECV, MSSQL-ECV, LDAP, POP3, CITRIX-XML-SERVICE, CITRIX-WEB-INTERFACE, DNS-TCP, RTSP, ARP, CITRIXAG, CITRIX-AAC-LOGINPAGE, CITRIX-AAC-LAS, CITRIX-XD-DDC, ND6, CITRIX-WIEXTENDED respCode The response codes to be deleted from the response codes list of the HTTP monitor. Example rm monitor http_mon http Related Commands add lb monitor set lb monitor unset lb monitor enable lb monitor disable lb monitor show lb monitor
set lb monitor
Synopsis set lb monitor <monitorName> <type> [-action <action>] [-respCode <int[-int]> ...] [-httpRequest <string>] [rtspRequest <string>] [-customHeaders <string>] [-maxForwards <positive_integer>] [-sipMethod <sipMethod>] [-sipregURI <string>] [-sipURI <string>] [-send <string>] [-recv <string>] [-query <string>] [-queryType <queryType>] [-userName <string>] {-password } {-secondaryPassword } [-logonpointName <string>] [-lasVersion <string>] {-radKey } [-radNASid <string>] [-radNASip <ip_addr>] [-LRTM ( ENABLED | DISABLED )] [deviation <positive_integer> [<units>]] [-scriptName <string>] [-scriptArgs <string>] [-validateCred ( YES | NO )] [-domain <string>] [-dispatcherIP <ip_addr>] [-dispatcherPort <port>] [-interval <integer> [<units>]] [-resptimeout <integer> [<units>]] [-resptimeoutThresh <positive_integer>] [-retries <integer>] [-failureRetries <integer>] [alertRetries <integer>] [-successRetries <integer>] [-downTime <integer> [<units>]] [-destIP <ip_addr|ipv6_addr>] [-destPort <port>] [-state ( ENABLED | DISABLED )] [-reverse ( YES | NO )] [-transparent ( YES | NO )] [-ipTunnel ( YES | NO )] [-tos ( YES | NO )] [-tosId <positive_integer>] [-secure ( YES | NO )] [-IPAddress <ip_addr|ipv6_addr| *> ...] [-group <string>] [-fileName <string>] [-baseDN <string>] [-bindDN <string>] [-filter <string>] [-attribute <string>] [-database <string>] [-sqlQuery <text>] [-evalRule <expression>] [-snmpOID <string>] [-snmpCommunity <string>] [-snmpThreshold <string>] [-snmpVersion ( V1 | V2 )] [-metricTable <string>] [-metric <string> [metricThreshold <positive_integer>] [-metricWeight <positive_integer>]] [-application <string>] [-sitePath <string>] [-netProfile <string>] [-mssqlProtocolVersion <mssqlProtocolVersion>] Description Use this command to modify the parameters of a specific monitor. Arguments monitorName The name of the monitor that is being set. type The type of monitor. Possible values: PING, TCP, HTTP, TCP-ECV, HTTP-ECV, UDP-ECV, DNS, FTP, LDNS-PING, LDNS-TCP, LDNS-DNS, RADIUS, USER, HTTP-INLINE, SIP-UDP,
LOAD, FTP-EXTENDED, SMTP, SNMP, NNTP, MYSQL, MYSQL-ECV, MSSQL-ECV, LDAP, POP3, CITRIX-XML-SERVICE, CITRIX-WEB-INTERFACE, DNS-TCP, RTSP, ARP, CITRIXAG, CITRIX-AAC-LOGINPAGE, CITRIX-AAC-LAS, CITRIX-XD-DDC, ND6, CITRIX-WIEXTENDED action The action to be taken in INLINE monitors. Possible values: NONE, LOG, DOWN Default value: SM_DOWN respCode The response codes. httpRequest The HTTP request that is sent to the server. rtspRequest The RTSP request that is sent to the server (for example, "OPTIONS *"). customHeaders The string that is sent to the service. Applicable to HTTP and HTTP-ECV monitor types. maxForwards SIP packet max-forwards Default value: 1 Maximum value: 255 sipMethod SIP method to be used for the query Possible values: OPTIONS, INVITE, REGISTER sipURI SIP uri string, sent to the server. For example "sip:sip.test". send The string that is sent to the service. recv The string that is expected from the server to mark the server as UP. query The DNS query (domain name) sent to the DNS service that is being monitored. queryType The type of DNS query that is sent. Possible values: Address, Zone, AAAA userName Username on the RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/MSSQL/POP3/CITRIX-AG/ CITRIX-XD-DDC/CITRIX-WI-EXTENDED server. This user name is used in the probe. password Password used in RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/POP3/LDAP/CITRIX-AG/ CITRIX-XD-DDC/CITRIX-WI-EXTENDED server monitoring. secondaryPassword Secondary password used in Citrix Access Gateway server monitoring. logonpointName Logonpoint name used in Citrix AAC login page and logon agent service monitoring. lasVersion The version of the Citrix AAC logon agent service required by CITRIX-AAC-LAS monitor. radKey The radius key. radNASid
The NAS ID to be used in Radius monitoring. radNASip The NAS IP to be used in Radius monitoring. LRTM The state of response time calculation of probes. Possible values: ENABLED, DISABLED deviation Deviation from the learnt response time for Dynamic Response Time monitoring. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes. Maximum value: 20939000 scriptName The path and name of the script to execute. scriptArgs The string that are put in the POST data - they are copied to the request verbatim. validateCred Setting this field triggers the monitor to send probe which validate the credentials of the Xen Desktop DDC. Possible values: YES, NO Default value: NO domain Domain name required by the monitors. This is for the Xen Desktop DDC monitor to validate the credentials and CITRIX-WI-EXTENDED monitor for logon process. dispatcherIP The IP Address of the dispatcher to which the probe is sent. dispatcherPort The port of the dispatcher to which the probe is sent. interval The frequency at which the probe is sent to the service.The minimum value is 20 msec.The maximum value is 20940000 in milliseconds , 20940 in seconds and 349 in minutes Default value: 5 Minimum value: 1 Maximum value: 20940000 resptimeout The interval for which the system waits before it marks the probe as FAILED. The minimum value is 10 msec. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes. Default value: 2 Minimum value: 1 Maximum value: 20939000 resptimeoutThresh Monitor response timeout threshold , a trap will be sent if the response time for the monitoring probes exceeds the thereshold. It is given in percentage. Maximum value: 100 retries The maximum number of most recent probes considered to decide whether to mark the service as DOWN. Minimum value of retries is 1. Default value: 3 Minimum value: 1 Maximum value: 127 failureRetries The number of failed probes out of most recent "retries" number of probes required to mark the service as DOWN. By default, the system requires "retries" number of consecutive probe failures to mark the service as DOWN. Maximum value: 32 alertRetries The number of probes failures after which the system generates a snmp trap. Maximum value: 32 successRetries
The number of consecutive sucessful probes required to mark the service as UP. Default value: 1 Minimum value: 1 Maximum value: 32 downTime The duration for which the system waits to make the next probe once the service is marked as DOWN. The minimum value is 10 msec. The maximum value is 20939000 in milliseconds , 20939 in seconds and 348 in minutes Default value: 30 Minimum value: 1 Maximum value: 20939000 destIP The IP address to which the probe is sent. destPort The TCP/UDP port to which the probe is sent. state The state of the monitor. Possible values: ENABLED, DISABLED Default value: ENABLED reverse The state of reverse probe's criterion check. Possible values: YES, NO Default value: NO transparent The state of the monitor for transparent devices. Possible values: YES, NO Default value: NO ipTunnel The state of the monitor for tunneled devices. Possible values: YES, NO Default value: NO tos If enabled, the probe is sent to the service by encoding the specified destination IP address in the IP TOS (6)bits. Possible values: YES, NO tosId Use this parameter to specify the TOS ID of the specified destination IP. Applicable only when the tos is enabled Minimum value: 1 Maximum value: 63 secure The state of the secure monitoring of services. Possible values: YES, NO Default value: NO IPAddress List of IP address to be checked against the response to the DNS monitoring probe. Applicable only to the DNS monitors. group Group name to be queried for NNTP monitor. fileName File name to be used for FTP-EXTENDED monitor. baseDN Base name for the LDAP monitor. bindDN BDN name for the LDAP monitor. filter Filter for the LDAP monitor. attribute Attribute for the LDAP monitor. database Database to be used for the MYSQL/MSSQL monitor. sqlQuery
SQL query to be used for the MYSQL/MSSQL monitor. evalRule Rule evaluated to determine the state of MYSQL/MSSQL monitor. snmpOID OID to be used for the SNMP monitor. snmpCommunity Community to be used for the SNMP monitor. snmpThreshold Threshold to be used for the SNMP monitor. snmpVersion SNMP version to be used for SNMP monitoring. Possible values: V1, V2 metricTable Metric table to use for the metrics that are going to be bound. metric Metric name in the metric table, whose setting is changed. A value zero disables the metric and it will not be used for load calculation application Name of the application that has to be executed to check the state of the service sitePath URL of the logon page. To get the dynamic page under sitepath, this sitepath must be specified ending with "/". netProfile The name of the network profile. mssqlProtocolVersion Protocol Version used by MSSQL monitor Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_70 Example set monitor http_mon http -respcode 100
Related Commands add lb monitor rm lb monitor unset lb monitor enable lb monitor disable lb monitor show lb monitor
unset lb monitor
Synopsis unset lb monitor <monitorName> <type> [-IPAddress <ip_addr|ipv6_addr|*> ...] [-scriptName] [-destPort] [netProfile] [-action] [-respCode] [-httpRequest] [-rtspRequest] [-customHeaders] [-maxForwards] [-sipMethod] [-
sipregURI] [-send] [-recv] [-query] [-queryType] [-userName] [-password] [-secondaryPassword] [-logonpointName] [-lasVersion] [-radKey] [-radNASid] [-radNASip] [-LRTM] [-deviation] [-scriptArgs] [-validateCred] [-domain] [-dispatcherIP] [-dispatcherPort] [-interval] [-resptimeout] [-resptimeoutThresh] [-retries] [-failureRetries] [alertRetries] [-successRetries] [-downTime] [-destIP] [-state] [-reverse] [-transparent] [-ipTunnel] [-tos] [-tosId] [-secure] [-group] [-fileName] [-baseDN] [-bindDN] [-filter] [-attribute] [-database] [-sqlQuery] [-evalRule] [snmpOID] [-snmpCommunity] [-snmpThreshold] [-snmpVersion] [-metricTable] [-mssqlProtocolVersion] Description Use this command to modify the parameters of a specific monitor..Refer to the set lb monitor command for meanings of the arguments. Arguments Example set monitor dns_mon dns -ipaddress 10.102.27.230 Related Commands add lb monitor rm lb monitor set lb monitor enable lb monitor disable lb monitor show lb monitor
enable lb monitor
Synopsis enable lb monitor (<serviceName>@ | <serviceGroupName>@) [<monitorName>] Description Enable the monitor that is bound to a specific service. If no monitor name is specified, all monitors bound to the service are enabled. Arguments serviceName The name of the service to which the monitor is bound. serviceGroupName The name of the service group to which the monitor is to be bound. monitorName The name of the monitor. Example enable monitor http_svc http_mon To enable monitor for multiple services use the following command: enable monitor http_svc[1-3] http_mon Related Commands add lb monitor
rm lb monitor set lb monitor unset lb monitor disable lb monitor show lb monitor
disable lb monitor
Synopsis disable lb monitor (<serviceName>@ | <serviceGroupName>@) [<monitorName>] Description Disable the monitor for a service. If the monitor name is not specified, all monitors bound to the service are disabled. Arguments serviceName The name of the service being monitored. serviceGroupName The name of the service group being monitored. monitorName The name of the monitor. Example disable monitor http_svc http_mon To disable a monitor on multiple services use the following command: disable monitor http_svc[1-3] http_mon
Related Commands add lb monitor rm lb monitor set lb monitor unset lb monitor enable lb monitor show lb monitor
bind lb monitor
Synopsis bind lb monitor <monitorName> ((<serviceName>@ [-state ( ENABLED | DISABLED )] [-weight <positive_integer>]) | ((<serviceGroupName>@ [-state ( ENABLED | DISABLED )] [-weight <positive_integer>]) | (-metric <string> -metricThreshold <positive_integer> [-metricWeight <positive_integer>]))) Description Use this command to bind a monitor to a service. Multiple monitors can be bound to the service. The server's state is determined by the state of all the bound monitors using the AND condition. All monitor's probes have to succeed for the service to be in the UP state.
Arguments monitorName The name of the monitor to be bound. serviceName The name of the service or a service group to which the monitor is to be bound. serviceGroupName The name of the service group to which the monitor is to be bound. metric The name of the metric from the table to be used for this monitor. Example bind monitor http_mon http_svc To bind a monitor to multiple services use the following command: bind monitor http_mon http_svc[1-3] Related Commands unbind lb monitor
unbind lb monitor
Synopsis unbind lb monitor <monitorName> (<serviceName>@ | <serviceGroupName>@ | -metric <string>) Description Use this command to unbind a specified monitor from the service. Arguments monitorName The name of the monitor to be unbound. serviceName The service name from which the monitor is to be unbound. serviceGroupName The service group name from which the monitor is to be unbound. metric The name of the metric from the table to be used for this monitor. Example unbind monitor http_mon http_svc To unbind a monitor to multiple services use the following command: unbind monitor http_mon http_svc[1-3] Related Commands bind lb monitor
show lb monitor
Synopsis show lb monitor [<monitorName>] [<type>] show lb monitor bindings - alias for 'show lb monbindings'
Description Display the parameters for the specified monitor. If the monitor_name argument is not specified, a list of all existing monitors is returned. Arguments monitorName The name of the monitor. type The type of monitor. Possible values: PING, TCP, HTTP, TCP-ECV, HTTP-ECV, UDP-ECV, DNS, FTP, LDNS-PING, LDNS-TCP, LDNS-DNS, RADIUS, USER, HTTP-INLINE, SIP-UDP, LOAD, FTP-EXTENDED, SMTP, SNMP, NNTP, MYSQL, MYSQL-ECV, MSSQL-ECV, LDAP, POP3, CITRIX-XML-SERVICE, CITRIX-WEB-INTERFACE, DNS-TCP, RTSP, ARP, CITRIXAG, CITRIX-AAC-LOGINPAGE, CITRIX-AAC-LAS, CITRIX-XD-DDC, ND6, CITRIX-WIEXTENDED summary fullValues format level interval The frequency at which the probe is sent to the service. units monitor interval units resptimeout The interval for which the system waits before it marks the probe as FAILED. resptimeoutThresh Monitor response timeout threshold , a trap will be sent if the response time for the monitoring probes exceeds the thereshold. It is given in percentage. units monitor response timeout units retries The maximum number of most recent probes considered to decide whether to mark the service as DOWN. Minimum value of retries is 1. failureRetries The number of failed probes out of most recent "retries" number of probes required to mark the service as DOWN. By default, the system requires "retries" number of consecutive probe failures to mark the service as DOWN. alertRetries The number of failures after which the system generates a SNMP trap. successRetries The number of consecutive sucessful probes required to mark the service as UP. downTime The duration in seconds for which the system waits to make the next probe once the service is marked as DOWN. units monitor downtime units
destIP The IP address to which the probe is sent. destPort The TCP/UDP port to which the probe is sent. state The state of the monitor. reverse The state of reverse probe's criterion check. transparent The state of the monitor for transparent devices. ipTunnel The state of the monitor for tunneled devices. tos TOS setting. tosId TOS ID secure The state of the secure monitoring of services. action The action to be taken in INLINE monitors. respCode The response codes. httpRequest The HTTP request that is sent to the server. rtspRequest The RTSP request that is sent to the server. send The string that is sent to the service. recv The string that is expected from the server to mark the server as UP. query The DNS query (domain name) sent to the DNS service that is being monitored. queryType The type of DNS query that is sent. userName Username on the RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/POP3/CITRIX-XD-DDC/ CITRIX-WI-EXTENDED server. This user name is used in the probe. password Password used in RADIUS/NNTP/FTP/FTP-EXTENDED/MYSQL/POP3/LDAP/CITRIX-XDDDC/CITRIX-WI-EXTENDED server monitoring. secondaryPassword Secondary password used in Citrix Access Gateway server monitoring. logonpointName
Logonpoint name used in Citrix AAC login page monitoring. lasVersion The version of the Citrix AAC logon agent service required by CITRIX-AAC-LAS monitor. validateCred Setting this field causes the monitor to send probe which validate the credentials of the Xen Desktop DDC. domain Domain name required by the monitors. This is for the Xen Desktop DDC monitor to validate the credentials and CITRIX-WI-EXTENDED monitor for logon process. radKey The radius key. radNASid The NAS ID to be used in Radius monitoring. radNASip The NAS IP to be used in Radius monitoring. LRTM The state of response time calculation of probes. lrtmConf State of LRTM configuration on the monitor. deviation Deviation from the learnt response time for Dynamic Response Time monitoring. units Deviation units. dynamicResponseTimeout Response timeout of the DRTM enabled monitor , calculated dynamically based on the history and current response time. dynamicInterval Interval between monitoring probes for DRTM enabled monitor , calculated dynamically based monitor response time. scriptName The path and name of the script to execute. scriptArgs The string that are put in the POST data - they are copied to the request verbatim. dispatcherIP The IP Address of the dispatcher to which the probe is sent. dispatcherPort The port of the dispatcher to which the probe is sent. sipURI SIP method string, sent to the server. For example "OPTIONS sip:sip.test". sipMethod Specifies SIP method to be used for the query maxForwards Maximum number of hops a sip monitor packet can go.
sipregURI Specifies SIP user to be registered customHeaders The string that is sent to the service. Applicable to HTTP ,HTTP-ECV and RTSP monitor types. IPAddress List of IP address to be checked against the response to the DNS monitoring probe. Applicable only to the DNS monitors. group Group name to be queried for NNTP monitor. fileName File name to be used for FTP-EXTENDED monitor. baseDN Base name for the LDAP monitor. bindDN BDN name for the LDAP monitor. filter Filter for the LDAP monitor. attribute Attribute for the LDAP monitor. database Database to be used for the MYSQL/MSSQL monitor. sqlQuery SQL query to be used for the MYSQL/MSSQL monitor. evalRule Rule evaluated to determine the state of MYSQL/MSSQL monitor. snmpOID OID to be used for the SNMP monitor. snmpCommunity Community to be used for the SNMP monitor. snmpThreshold Threshold to be used for the SNMP monitor. snmpVersion SNMP version to be used for SNMP monitoring. metric Metric name in the metric table, whose setting is changed metricTable Metric table, whose setting is changed metricThreshold Threshold to be used for that metric. metricWeight The weight for the specified service metric with respect to others. flags
Flags controlling the display.NOTE: This attribute is deprecated.This is deprecated attribute. stateflag Flags controlling the display. application Name of the application that has to be executed to check the state of the service sitePath URL of the logon page. To get the dynamic page under sitepath, this sitepath must be specified ending with "/". units Giving the unit of the metric netProfile The name of the network profile. mssqlProtocolVersion Protocol Version used by MSSQL monitor count Example An example of the show monitor command output is as follows: 8 configured monitors: 1) Name.......: ping Type......: PING State....ENABLED 2) Name.......: tcp Type......: TCP State....ENABLED 3) Name.......: http Type......: HTTP State....ENABLED 4) Name.......: tcp-ecv Type......: TCP-ECV State....ENABLED 5) Name.......: http-ecv Type......: HTTPECV State....ENABLED 6) Name.......: udp-ecv Type......: UDP-ECV State....ENABLED 7) Name.......: dns Type......: DNS State....ENABLED 8) Name.......: ftp Type......: FTP State....ENABLED Related Commands add lb monitor rm lb monitor set lb monitor unset lb monitor enable lb monitor disable lb monitor
add lb route
Synopsis add lb route <network> <netmask> <gatewayName> Description Bind the route VIP to the route structure. Arguments network The IP address of the network to which the route belongs. netmask The netmask to which the route belongs. gatewayName
The name of the route. Example Related Commands rm lb route show lb route
rm lb route
Synopsis rm lb route <network> <netmask> Description Remove the route VIP from the route structure. Arguments network The IP address of the network to which the route VIP belongs. netmask The netmask of the destination network. Example Related Commands add lb route show lb route
show lb route
Synopsis show lb route [<network> <netmask>] Description Display the names of the routes associated to the route structure using the ###add lb route### command. Arguments network The destination network or host. summary fullValues format level gatewayName The name of the route. flags State of the configured gateway. count
stateflag Example Related Commands add lb route rm lb route
add lb route6
Synopsis add lb route6 <network> <gatewayName> Description Bind the route VIP to the route structure. Arguments network The destination network. gatewayName The name of the route. Example Related Commands rm lb route6 show lb route6
rm lb route6
Synopsis rm lb route6 <network> Description Remove the route VIP from the route structure. Arguments network The IP address of the network to which the route VIP belongs. Example Related Commands add lb route6 show lb route6
show lb route6
Synopsis show lb route6 [<network>]
Description Display the names of the routes associated to the route structure using the ###add lb route6### command. Arguments network The destination network or host. summary fullValues format level gatewayName The name of the route. flags State of the configured gateway. count stateflag Example
Related Commands add lb route6 rm lb route6
add lb vserver
Synopsis add lb vserver <name>@ <serviceType> [(<IPAddress>@ <port> [-range <positive_integer>]) | (-IPPattern <ippat> -IPMask <ipmask>)] [-persistenceType <persistenceType>] [-timeout <mins>] [-persistenceBackup ( SOURCEIP | NONE )] [-backupPersistenceTimeout <mins>] [-lbMethod <lbMethod> [-hashLength <positive_integer>] [-netmask <netmask>] [-v6netmasklen <positive_integer>] ] [-rule <expression>] [-Listenpolicy <expression> [-Listenpriority <positive_integer>]] [-resRule <expression>] [-persistMask <netmask>] [v6persistmasklen <positive_integer>] [-pq ( ON | OFF )] [-sc ( ON | OFF )] [-rtspNat ( ON | OFF )] [-m <m>] [-tosId <positive_integer>] [-dataLength <positive_integer>] [-dataOffset <positive_integer>] [-sessionless ( ENABLED | DISABLED )] [-state ( ENABLED | DISABLED )] [-connfailover <connfailover>] [-redirectURL <URL>] [-cacheable ( YES | NO )] [-cltTimeout <secs>] [-soMethod <soMethod>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-soThreshold <positive_integer>] [-redirectPortRewrite ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-backupVServer <string>] [disablePrimaryOnDown ( ENABLED | DISABLED )] [-insertVserverIPPort <insertVserverIPPort> [<vipHeader>] ] [-AuthenticationHost <string>] [-Authentication ( ON | OFF )] [-authn401 ( ON | OFF )] [-authnVsName <string>] [-push ( ENABLED | DISABLED )] [-pushVserver <string>] [-pushLabel <expression>] [-pushMultiClients ( YES | NO )] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-l2Conn ( ON | OFF )] [mssqlServerVersion <mssqlServerVersion>] [-mysqlProtocolVersion <positive_integer>] [-mysqlServerVersion <string>] [-mysqlCharacterSet <positive_integer>] [-mysqlServerCapabilities <positive_integer>] [appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] [-icmpVsrResponse ( PASSIVE | ACTIVE )] [-newServiceRequest <positive_integer> [<newServiceRequestUnit>]] [-newServiceRequestIncrementInterval <positive_integer>]
Description Add a load balancing virtual server. Arguments name The name of the load balancing virtual server being added. serviceType The service type. Possible values: HTTP, FTP, TCP, UDP, SSL, SSL_BRIDGE, SSL_TCP, NNTP, DNS, DHCPRA, ANY, SIP_UDP, DNS_TCP, RTSP, PUSH, SSL_PUSH, RADIUS, RDP, MYSQL, MSSQL IPAddress The IP address of the virtual server. IPPattern The IP Pattern of the virtual server. port A port number for the virtual server. range The IP range for the network vserver. Default value: 1 Minimum value: 1 Maximum value: 254 persistenceType Persistence type for the virtual server. Note: The <persistenceType> parameter can take one of the following options: SOURCEIP - When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests arriving from the same IP as the first request to the same physical service. COOKIEINSERT - When configured, the system inserts an HTTP cookie into the client responses. The cookie is inserted into the "Cookie" header field of the HTTP response. The client stores the cookie (if enabled) and includes it in all the subsequent requests, which then match the cookie criteria. The cookie contains information about the service where the requests have to be sent. SSLSESSION ID - When configured, the system creates a persistence that is session based on the arriving SSL Session ID, which is part of the SSL handshake process. All requests with the same SSL session ID are directed to the initially selected physical service. CUSTOM SERVER ID -This mode of Persistence requires the server to provide its Server-ID in such a way that it can be extracted from subsequent requests. The system extracts the Server-ID from subsequent client requests and uses it to select a server. The server embeds the Server-ID into the URL query of the HTML links, accessible from the initial page that has to generate persistent HTTP requests. RULE - When configured, the system maintains persistence based on the contents of the matched rule. This persistence requires an expression to be configured. The expression is created using the add expression CLI command and is configured on a virtual server, using the -rule option of the add lb vserver or set lb vserver CLI command.After successful evaluation of the expression, a persistence session is created and all subsequent matching client requests are directed to the previously selected server. URLPASSIVE - This mode of Persistence requires the server to provide its Server-ID in such a way that it can be extracted from subsequent requests.The system extracts the Server-ID from subsequent client requests and uses it to select a server. The servers which require persistence, embed the Server-ID into the URL query of the HTML links, accessible from the initial page. The Server-ID is its IP address and port specified as a hexadecimal number.URL Passive persistence type requires an expression to be configured that specifies the location of the Server-ID in the client's requests. The expression is created using the CLI command add expression. This expression is configured on a virtual server, using option rule of the add lb vserver or set lb vserver CLI command. DESTIP -When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests with the same destination as the first packet to the same physical service. This will be used in LLB deployment scenarios. SRCIPDESTIP - When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests with the same Source IP and Destination IP as the first packet to the same physical service. This will
be used in IDS LB depolyments. CALLID - When configured, the system maintains persistence based on CALLID used in the SIP transactions. All the SIP transactions with same CALLID are directed to the same server. RTSPSID - When configured, the system maintains persistence based on RTSP sessionID provided by the server. The client also sends the same RTSP sessionID in the subsequent requests which are then directed to the same server. Possible values: SOURCEIP, COOKIEINSERT, SSLSESSION, RULE, URLPASSIVE, CUSTOMSERVERID, DESTIP, SRCIPDESTIP, CALLID, RTSPSID, NONE timeout The time period for which the persistence is in effect for a specific client. The value ranges from 2 to 1440 minutes. Default value: 2 Maximum value: 1440 persistenceBackup Use this parameter to specify a backup persistence type for the virtual server. The Backup persistence option is used when the primary configured persistence mechanism on virtual server fails. The <persistenceBacup> parameter can take one of the following options: SOURCEIP NONE Possible values: SOURCEIP, NONE backupPersistenceTimeout The maximum time backup persistence is in effect for a specific client. Default value: 2 Minimum value: 2 Maximum value: 1440 lbMethod The load balancing method for the virtual server. The valid options for this parameter are: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, URLHASH, DOMAINHASH, DESTINATIONIPHASH, SOURCEIPHASH, SRCIPDESTIPHASH,LEASTBANDWIDTH, LEASTPACKETS, TOKEN, SRCIPDESTIPHASH, CUSTOMLOAD, SRCIPSRCPORTHASH, LRTM, CALLIDHASSH. When the load balancing policy is configured as: ROUNDROBIN - When configured, the system distributes incoming requests to each server in rotation, regardless of the load. When different weights are assigned to services then weighted round robin occurs and requests go to services according to how much weighting has been set. LEASTCONNECTION (default value)- When configured, the system selects the service that has the least number of connections. For TCP, HTTP, HTTPS and SSL_TCP services the least number of connections includes: Established, active connections to a service. Connection reuse applies to HTTP and HTTPS. Hence the count includes only those connections which have outstanding HTTP or HTTPS requests, and does not include inactive, reusable connections. Connections to a service waiting in the Surge Queue, which exists only if the Surge Protection feature is enabled. For UDP services the least number of connections includes: The number of sessions between client and a physical service. These sessions are the logical, time-based entities, created on first arriving UDP packet. If configured, weights are taken into account when server selection is performed. LEASTRESPONSETIME - When configured, the system selects the service with the minimum average response time. The response time is the time interval taken when a request is sent to a service and first response packet comes back from the service, that is Time to First Byte (TTFB). URLHASH - The system selects the service based on the hashed value of the incoming URL.To specify the number of bytes of the URL that is used to calculate the hash value use the optional argument [-hashLength <positive_integer>] in either the add lb vserver or set lb vserver CLI command. The default value is 80. DOMAINHASH When configured with this load balancing method, the system selects the service based on the hashed value of the domain name in the HTTP request. The domain name is taken either from the incoming URL or from the Host header of the HTTP request. Note: The system defaults to LEASTCONNECTION if the request does not contain a domain name. If the domain name appears in both the URL and the host header, the system gives preference to the URL domain. DESTINATIONIPHASH - The system selects the service based on the hashed value of the destination IP address in the TCP IP header. SOURCEIPHASH - The system selects the service based on the hashed value of the client's IP address in the IP header. LEASTBANDWIDTH - The system selects the service that is currently serving the least traffic, measured in megabits per second. LEASTPACKETS - The system selects the service that is currently serving the lowest number
of packets per second. Token -The system selects the service based on the value, calculated from a token, extracted from the client's request (location and size of the token is configurable or by evaluating the rule configured). For subsequent requests with the same token, the systems will select the same physical server. SRCIPDESTIPHASH - The system selects the service based on the hashed value of the client's SOURCE IP and DESTINATION IP address in the TCP IP header. CUSTOMLOAD - The system selects the service based on the it load which was determined by the LOAD monitors bound to the service. SRCIPSRCPORTHASH - The system selects the service based on the hashed value of the client's SOURCE IP and SOURCE PORT in the TCP/ UDP+IP header. LRTM - When configured, the system selects the service with least response time learned through probing(number of active connections taken into account in addition to the response time). CALLIDHASSH - The system selects the service based on the hashed value of SIP callid. Possible values: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, URLHASH, DOMAINHASH, DESTINATIONIPHASH, SOURCEIPHASH, SRCIPDESTIPHASH, LEASTBANDWIDTH, LEASTPACKETS, TOKEN, SRCIPSRCPORTHASH, LRTM, CALLIDHASH, CUSTOMLOAD Default value: PEMGMT_LB_LEASTCONNS rule Use this parameter to specify the string value used to set the RULE persistence type. The string can be either an existing rule name (configured using add expression command) or else it can be an inline expression with a maximum of 1499 characters. Default value: "none" Listenpolicy Use this parameter to specify the listen policy for LB Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1499 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of LB Vserver. Default value: 101 Maximum value: 101 resRule Use this parameter to specify the expression to be used in response for RULE persistence type. The string is an in-line expression with a maximum of 1499 characters. Default value: "none" persistMask Use this parameter to specify if the persistency is IP based. This parameter is Optional. Default value: 0xFFFFFFFF v6persistmasklen The persistence mask. Use this parameter if you are using IP based persistence type on a ipv6 vserver. Default value: 128 Minimum value: 1 Maximum value: 128 pq Use this parameter to enable priority queuing on the specified virtual server. Possible values: ON, OFF Default value: OFF sc Use this parameter to enable SureConnect on the specified virtual server. Possible values: ON, OFF Default value: OFF rtspNat Use this parameter to enable natting for RTSP data connection. Possible values: ON, OFF Default value: OFF m Use this parameter to specify the LB mode. If the value is specified as IP then the traffic is sent to the physical servers by changing the destination IP address to that of the physical server. If the value is MAC then the traffic is sent to the physical servers , by changing the destination MAC address to that of one of the physical servers, the destination IP is not changed. MAC mode is used mostly
in Firewall Load Balancing scenario. Possible values: IP, MAC, IPTUNNEL, TOS Default value: NSFWD_IP tosId Use this parameter to specify the TOS ID of this vserver. Applicable only when the LB mode is TOS Minimum value: 1 Maximum value: 63 dataLength Use this parameter to specify the length of the token in bytes. Applicable to TCP virtual servers, when Token Load Balancing method is selected. The datalength should not be more than 24k. Maximum value: 100 dataOffset Use this parameter to specifies offset of the data to be taken as token. Applicable to the TCP type virtual servers, when Token load balancing method is used. Must be within the first 24k of the client TCP data. Maximum value: 25400 sessionless Use this parameter to enable sessionless load balancing. Possible values: ENABLED, DISABLED Default value: DISABLED state The state of the load balancing virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED connfailover Specifies the connection failover mode of the virtual server Possible values: DISABLED, STATEFUL, STATELESS Default value: DISABLED redirectURL The URL where traffic is redirected if the virtual server in the system becomes unavailable. You can enter up to 127 characters as the URL argument. WARNING! Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the add cs policy CLI command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system - then the user may not get the requested content. cacheable Use this option to specify whether a virtual server, used for load balancing or content switching, routes requests to the cache redirection virtual server before sending it to the configured servers. Possible values: YES, NO Default value: NO cltTimeout The timeout value in seconds for idle client connection Default value: VAL_NOT_SET Maximum value: 31536000 soMethod The spillover factor based on which the traffic will be given to the backupvserver once the main virtual server reaches the spillover threshold. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence The state of the spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The spillover persistency entry timeout. Default value: 2 Minimum value: 2 Maximum value: 1440 soThreshold
In case of CONNECTION (or) DYNAMICCONNECTION type spillover method this value is treated as Maximum number of connections an lb vserver will handle before spillover takes place. In case of BANDWIDTH type spillover method this value is treated as the amount of incoming and outgoing traffic (in Kbps) a Vserver will handle before spillover takes place. In case of HEALTH type spillover method if the percentage of active services (by weight) becomes lower than this value, spillover takes place Minimum value: 1 Maximum value: 4294967287 redirectPortRewrite The state of port rewrite while performing HTTP redirect. Possible values: ENABLED, DISABLED Default value: DISABLED downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED backupVServer The Backup Virtual Server. disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED insertVserverIPPort The virtual IP and port header insertion option for the vserver. VIPADDR - Header contains the vserver's IP address and port number without any translation. OFF - The virtual IP and port header insertion option is disabled. V6TOV4MAPPING - Header contains the mapped IPv4 address corresponding to the IPv6 address of the vserver and the port number. An IPv6 address can be mapped to a user-specified IPv4 address using the set ns ip6 command. Possible values: OFF, VIPADDR, V6TOV4MAPPING AuthenticationHost FQDN of authentication vserver Authentication This option toggles on or off the application of authentication of incoming users to the vserver. Possible values: ON, OFF Default value: OFF authn401 This option toggles on or off the HTTP 401 response based authentication. Possible values: ON, OFF Default value: OFF authnVsName Name of authentication vserver push Process traffic on bound Push vserver. Possible values: ENABLED, DISABLED Default value: DISABLED pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. Default value: "none" pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. Possible values: YES, NO Default value: NO
tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF mssqlServerVersion The version of the MSSQL server Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_2008B mysqlProtocolVersion The protocol version returned by the mysql vserver. Default value: NSA_MYSQL_PROTOCOL_VER_DEFAULT mysqlServerVersion The server version string returned by the mysql vserver. Default value: NSA_MYSQL_SERVER_VER_DEFAULT mysqlCharacterSet The character set returned by the mysql vserver. Default value: NSA_MYSQL_CHAR_SET_DEFAULT mysqlServerCapabilities The server capabilities returned by the mysql vserver. Default value: NSA_MYSQL_SVR_CAPABILITIES_DEFAULT appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE newServiceRequest The number of requests/sec or percentage of requests/sec a new service should receive compared to the existing services. The maximum possible value for requests/sec is 65536 and percentage of requests is 100 newServiceRequestIncrementInterval The interval in seconds after which the new services requests limit should be automatically increased. Maximum value: 3600 Example add lb vserver http_vsvr http 10.102.1.10 80 To add multiple vservers at once use the following command: add lb vs http_vsvr[1-4] http 10.102.27.[115-118] 80 This command adds the vserver http_vsvr1 with the IP address 10.102.27.115, http_vsvr2 with 10.102.27.116, http_vsvr3 with 10.102.27.117 and http_vsvr4 with 10.102.27.118 Related Commands rm lb vserver
set lb vserver unset lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver rename lb vserver
rm lb vserver
Synopsis rm lb vserver <name>@ ... Description Remove a virtual server. Arguments name The name of the virtual server to be removed. Example rm vserver lb_vip To remove multiple vservers use the following command: rm vserver lb_vip[1-3] Related Commands add lb vserver set lb vserver unset lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver rename lb vserver
set lb vserver
Synopsis set lb vserver <name>@ [-IPAddress <ip_addr|ipv6_addr|*>@] [-IPPattern <ippat>] [-IPMask <ipmask>] [-weight <positive_integer> <serviceName>@] [-persistenceType <persistenceType>] [-timeout <mins>] [-persistenceBackup ( SOURCEIP | NONE )] [-backupPersistenceTimeout <mins>] [-lbMethod <lbMethod> [-hashLength <positive_integer>] [-netmask <netmask>] [-v6netmasklen <positive_integer>] ] [-rule <expression>] [-resRule <expression>] [-persistMask <netmask>] [-v6persistmasklen <positive_integer>] [-pq ( ON | OFF )] [-sc ( ON | OFF )] [-rtspNat ( ON | OFF )] [-m <m>] [-tosId <positive_integer>] [-dataLength <positive_integer>] [-dataOffset <positive_integer>] [-sessionless ( ENABLED | DISABLED )] [-connfailover <connfailover>] [-backupVServer <string>] [-redirectURL <URL>] [-cacheable ( YES | NO )] [-cltTimeout <secs>] [-soMethod <soMethod>] [-soThreshold <positive_integer>] [-soPersistence ( ENABLED | DISABLED )] [-soPersistenceTimeOut <positive_integer>] [-redirectPortRewrite ( ENABLED | DISABLED )] [-downStateFlush ( ENABLED | DISABLED )] [-insertVserverIPPort <insertVserverIPPort> [<vipHeader>] ] [-disablePrimaryOnDown ( ENABLED
| DISABLED )] [-AuthenticationHost <string>] [-Authentication ( ON | OFF )] [-authn401 ( ON | OFF )] [authnVsName <string>] [-push ( ENABLED | DISABLED )] [-pushVserver <string>] [-pushLabel <expression>] [pushMultiClients ( YES | NO )] [-Listenpolicy <expression>] [-Listenpriority <positive_integer>] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-l2Conn ( ON | OFF )] [-mssqlServerVersion <mssqlServerVersion>] [-mysqlProtocolVersion <positive_integer>] [-mysqlServerVersion <string>] [mysqlCharacterSet <positive_integer>] [-mysqlServerCapabilities <positive_integer>] [-appflowLog ( ENABLED | DISABLED )] [-netProfile <string>] [-icmpVsrResponse ( PASSIVE | ACTIVE )] [-newServiceRequest <positive_integer>] [<newServiceRequestUnit>] [-newServiceRequestIncrementInterval <positive_integer>] Description Set load balancing virtual server attributes. Arguments name The name of the load balancing virtual server. IPAddress The new IP address of the virtual server. IPPattern The IP Pattern of the virtual server. IPMask The IP Mask of the virtual server IP Pattern weight The weight for the specified service. Minimum value: 1 Maximum value: 100 persistenceType Persistence type for the virtual server. Note: The <persistenceType> parameter can take one of the following options: SOURCEIP - When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests arriving from the same IP as the first request to the same physical service. COOKIEINSERT - When configured, the system inserts an HTTP cookie into the client responses. The cookie is inserted into the "Cookie" header field of the HTTP response. The client stores the cookie (if enabled) and includes it in all the subsequent requests, which then match the cookie criteria. The cookie contains information about the service where the requests have to be sent. SSLSESSION ID - When configured, the system creates a persistence that is session based on the arriving SSL Session ID, which is part of the SSL handshake process. All requests with the same SSL session ID are directed to the initially selected physical service. CUSTOM SERVER ID -This mode of Persistence requires the server to provide its Server-ID in such a way that it can be extracted from subsequent requests. The system extracts the Server-ID from subsequent client requests and uses it to select a server. The server embeds the Server-ID into the URL query of the HTML links, accessible from the initial page that has to generate persistent HTTP requests. RULE - When configured, the system maintains persistence based on the contents of the matched rule. This persistence requires an expression to be configured. The expression is created using the add expression CLI command and is configured on a virtual server, using the -rule option of the add lb vserver or set lb vserver CLI command.After successful evaluation of the expression, a persistence session is created and all subsequent matching client requests are directed to the previously selected server. URLPASSIVE - This mode of Persistence requires the server to provide its Server-ID in such a way that it can be extracted from subsequent requests.The system extracts the Server-ID from subsequent client requests and uses it to select a server. The servers which require persistence, embed the Server-ID into the URL query of the HTML links, accessible from the initial page. The Server-ID is its IP address and port specified as a hexadecimal number.URL Passive persistence type requires an expression to be configured that specifies the location of the Server-ID in the client's requests. The expression is created using the CLI command add expression. This expression is configured on a virtual server, using option rule of the add lb vserver or set lb vserver CLI command. DESTIP -When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests with the same destination as the first packet to the same physical service. This will be used
in LLB deployment scenarios. SRCIPDESTIP - When configured, the system selects a physical service based on the Load Balancing method, and then directs all the subsequent requests with the same Source IP and Destination IP as the first packet to the same physical service. This will be used in IDS LB depolyments. CALLID - When configured, the system maintains persistence based on CALLID used in the SIP transactions. All the SIP transactions with same CALLID are directed to the same server. RTSPSID - When configured, the system maintains persistence based on RTSP sessionID provided by the server. The client also sends the same RTSP sessionID in the subsequent requests which are then directed to the same server. Possible values: SOURCEIP, COOKIEINSERT, SSLSESSION, RULE, URLPASSIVE, CUSTOMSERVERID, DESTIP, SRCIPDESTIP, CALLID, RTSPSID, NONE timeout The maximum time persistence is in effect for a specific client. Default value: 2 Maximum value: 1440 persistenceBackup The backup persistency to be used when the primary persistency fails. For the backup persistency to be active the primary persistency must be COOKIEINSERT. Possible values: SOURCEIP, NONE backupPersistenceTimeout The maximum time backup persistence is in effect for a specific client. Default value: 2 Minimum value: 2 Maximum value: 1440 lbMethod The load balancing method to be in effect: ROUNDROBIN: When selected, determines the destination of a request based on the performance weight (configured by the -weight argument of the ###set lb vserver### command). LEASTCONNECTION: When selected, determines the destination of a request based on the least number of active connections from the system to each physical service bound to the virtual server. LEASTRESPONSETIME: When selected, determines the destination of a request based on the average response time. URLHASH: When selected, determines the destination of a request by hashing the URL. DOMAINHASH: When selected, determines the destination of a request by hashing the domain name DESTINATIONHASH: When selected, determines the destination of a request by hashing the destination IP address or destination network. SOURCEIPHASH: When selected, determines the destination of a request by hashing the source IP address or source network. LEASTBANDWIDTH: When selected, determines the destination of a request based on the bandwidth utilization. LEASTPACKETS: When selected, determines the destination of a request based on number of packets. Token: When selected, determines the destination of a request based on the value, calculated from a token, extracted from the client's request (location and size of the token is configurable or by evaluating the rule configured). CUSTOMLOAD: The system selects the service based on the it load which w as determined by the LOAD monitors bound to the service. SRCIPSRCPORTHASH - The system selects the service based on the hashed value of the client's SOURCE IP and SOURCE PORT in the TCP/UDP+IP header. LRTM - When configured, the system selects the service with least response time learned through probing(number of active connections taken into account in addition to the response time). CALLIDHASSH - The system selects the service based on the hashed value of SIP callid. Possible values: ROUNDROBIN, LEASTCONNECTION, LEASTRESPONSETIME, URLHASH, DOMAINHASH, DESTINATIONIPHASH, SOURCEIPHASH, SRCIPDESTIPHASH, LEASTBANDWIDTH, LEASTPACKETS, TOKEN, SRCIPSRCPORTHASH, LRTM, CALLIDHASH, CUSTOMLOAD Default value: PEMGMT_LB_LEASTCONNS rule The RULE persistence type. The string can be either a existing rule name (configured using add expression command)or else it could it be an inline expression with a maximum of 1499 characters. Default value: "none" resRule
Use this parameter to specify the expression to be used in response for RULE persistence type. The string is an in-line expression with a maximum of 1499 characters. Default value: "none" persistMask The persistence mask. Use this parameter if you are using IP based persistence type. Default value: 0xFFFFFFFF v6persistmasklen The persistence mask. Use this parameter if you are using IP based persistence type on a ipv6 vserver. Default value: 128 Minimum value: 1 Maximum value: 128 pq The state of priority queuing on the specified virtual server. Possible values: ON, OFF Default value: OFF sc The state of SureConnect the specified virtual server. Possible values: ON, OFF Default value: OFF rtspNat Use this parameter to enable natting for RTSP data connection. Possible values: ON, OFF Default value: OFF m The LB mode. This option is designed for firewall load balancing and cache redirection. IP Communicate to the server using server's IP address. MAC - Communicate to the server using server's MAC address. TUNNEL - Communicate to the server through an IP tunnel. TOS Communicate to server using TOS ID. Possible values: IP, MAC, IPTUNNEL, TOS Default value: NSFWD_IP tosId Use this parameter to specify the TOS ID of this vserver. Applicable only when the LB mode is TOS Minimum value: 1 Maximum value: 63 dataLength The data length when TOKEN load balancing method is selected. Minimum value: 1 Maximum value: 100 dataOffset The data offset length when TOKEN load balancing method is selected. Maximum value: 25400 sessionless The state of sessionless load balancing. Possible values: ENABLED, DISABLED Default value: DISABLED connfailover Specifies the connection failover mode of the virtual server Possible values: DISABLED, STATEFUL, STATELESS Default value: DISABLED backupVServer The Backup Virtual Server. redirectURL The redirect URL. cacheable The state of caching. Possible values: YES, NO Default value: NO cltTimeout The client timeout in seconds. Default value: VAL_NOT_SET Maximum value: 31536000 soMethod
The spillover method to be in effect. Possible values: CONNECTION, DYNAMICCONNECTION, BANDWIDTH, HEALTH, NONE soPersistence State of spillover persistence. Possible values: ENABLED, DISABLED Default value: DISABLED soPersistenceTimeOut The maximum time persistence is in effect for a specific client on a spillover vserver. Default value: 2 Minimum value: 2 Maximum value: 1440 redirectPortRewrite The state of port rewrite while performing HTTP redirect. Possible values: ENABLED, DISABLED Default value: DISABLED downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED insertVserverIPPort The virtual IP and port header insertion option for the vserver. VIPADDR - Header contains the vserver's IP address and port number without any translation. OFF - The virtual IP and port header insertion option is disabled. V6TOV4MAPPING - Header contains the mapped IPv4 address corresponding to the IPv6 address of the vserver and the port number. An IPv6 address can be mapped to a user-specified IPv4 address using the set ns ip6 command. Possible values: OFF, VIPADDR, V6TOV4MAPPING disablePrimaryOnDown When this argument is enabled, traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Possible values: ENABLED, DISABLED Default value: DISABLED AuthenticationHost FQDN of authentication vserver Authentication This option toggles on or off the application of authentication of incoming users to the vserver. Possible values: ON, OFF Default value: OFF authn401 This option toggles on or off the HTTP 401 response based authentication. Possible values: ON, OFF Default value: OFF authnVsName Name of authentication vserver push Process traffic on bound Push vserver. Possible values: ENABLED, DISABLED Default value: DISABLED pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. Default value: "none" pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. Possible values: YES, NO Default value: NO
Listenpolicy Use this parameter to specify the listen policy for LB Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1499 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of LB Vserver. Default value: 101 Maximum value: 101 tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. l2Conn Use L2 Parameters to identify a connection Possible values: ON, OFF mssqlServerVersion The version of the MSSQL server Possible values: 70, 2000, 2000SP1, 2005, 2008, 2008R2 Default value: TDS_PROT_2008B mysqlProtocolVersion The protocol version returned by the mysql vserver. Default value: NSA_MYSQL_PROTOCOL_VER_DEFAULT mysqlServerVersion The server version string returned by the mysql vserver. Default value: NSA_MYSQL_SERVER_VER_DEFAULT mysqlCharacterSet The character set returned by the mysql vserver. Default value: NSA_MYSQL_CHAR_SET_DEFAULT mysqlServerCapabilities The server capabilities returned by the mysql vserver. Default value: NSA_MYSQL_SVR_CAPABILITIES_DEFAULT appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED netProfile The name of the network profile. icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE newServiceRequest The number of requests/sec or percentage of requests/sec a new service should receive compared to the existing services. The maximum possible value for requests/sec is 65536 and percentage of requests is 100 newServiceRequestIncrementInterval The interval in seconds after which the new services requests limit should be automatically increased. Maximum value: 3600
Example set lb vserver http_vip -lbmethod LEASTRESPONSETIME To set the load balancing method for multiple vserver use the following command: set lb vserver http_vip[1-3] -lbmethod LEASTRESPONSETIME Related Commands add lb vserver rm lb vserver unset lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver rename lb vserver
unset lb vserver
Synopsis unset lb vserver <name>@ [-backupVServer] [-cltTimeout] [-redirectURL] [-AuthenticationHost] [-authnVsName] [-pushVserver] [-pushLabel] [-tcpProfileName] [-httpProfileName] [-rule] [-l2Conn] [-mysqlProtocolVersion] [-mysqlServerVersion] [-mysqlCharacterSet] [-mysqlServerCapabilities] [-appflowLog] [-netProfile] [icmpVsrResponse] [-serviceName] [-persistenceType] [-timeout] [-persistenceBackup] [-backupPersistenceTimeout] [-lbMethod] [-hashLength] [-netmask] [-v6netmasklen] [-resRule] [-persistMask] [-v6persistmasklen] [-pq] [sc] [-rtspNat] [-m] [-tosId] [-dataLength] [-dataOffset] [-sessionless] [-connfailover] [-cacheable] [-soMethod] [-soPersistence] [-soPersistenceTimeOut] [-redirectPortRewrite] [-downStateFlush] [-insertVserverIPPort] [vipHeader] [-disablePrimaryOnDown] [-Authentication] [-authn401] [-push] [-pushMultiClients] [-Listenpolicy] [-Listenpriority] [-comment] [-mssqlServerVersion] [-newServiceRequest] [-newServiceRequestUnit] [newServiceRequestIncrementInterval] Description Unset the backup virtual server or redirectURL set on the virtual server..Refer to the set lb vserver command for meanings of the arguments. Arguments Example unset lb vserver lb_vip -backupVServer To unset the backup virtual server for multiple vservers use the following command: unset lb vserver lb_vip[1-3] -backupVServer Related Commands add lb vserver rm lb vserver set lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver
rename lb vserver
bind lb vserver
Synopsis bind lb vserver <name>@ ((<serviceName>@ [-weight <positive_integer>]) | <serviceGroupName>@ | (policyName <string>@ [-priority <positive_integer>] [-gotoPriorityExpression <expression>] [-type ( REQUEST | RESPONSE )] [-invoke (<labelType> <labelName>) ] )) Description Bind a physical service to a virtual server. Arguments name The virtual server name to which the service is bound. serviceName The name of the service that is bound. serviceGroupName The name of the service group that is bound. policyName The SureConnect/priority queuing/Compression/AppSecure/Transform/Filter/Authorization/ Rewrite/Responder/Cache/Syslog/Nslog/TMTraffic policy that needs to be bound to the specified load balancing virtual server for SureConnect or priority queuing to be activated on a load balancing virtual server. Example bind lb vserver http_vip http_svc To bind a service to multiple vservers use the following command: bind lb vs http_vip[1-3] http_svc To bind multiple services to a vserver use the following command: bind lb vs http_vip http_svc[1-3] Related Commands unbind lb vserver
unbind lb vserver
Synopsis unbind lb vserver <name>@ (<serviceName>@ | <serviceGroupName>@ | (-policyName <string>@ [-type ( REQUEST | RESPONSE )])) [-priority <positive_integer>] Description Unbind a service or policy from a virtual server that has been configured for use in system's load balancing. Arguments name The virtual server name from which the service will be unbound. serviceName The service name (created with the addService command) that will be unbound. serviceGroupName The name of the service group that is unbound. policyName The SureConnect or priority queuing policy that has been bound to this load balancing virtual server, using the ###bind lb vserver### command.
priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind lb vserver http_vip http_svc To unbind a service from multiple vservers use the following command: unbind lb vs http_vip[1-3] http_svc To unbind multiple services from a vserver use the following command: unbind lb vs http_vip http_svc[1-3] Related Commands bind lb vserver
enable lb vserver
Synopsis enable lb vserver <name>@ Description Enable a virtual server. Note: Virtual servers, when added, are enabled by default. Arguments name The name of the virtual server to be enabled. Example enable vserver lb_vip To enable multiple vservers at once use the following command: enable vserver lb_vip[1-3] Related Commands add lb vserver rm lb vserver set lb vserver unset lb vserver disable lb vserver show lb vserver stat lb vserver rename lb vserver
disable lb vserver
Synopsis disable lb vserver <name>@ Description Disable (makes out of service) a virtual server. Arguments name The name of the virtual server to be disabled. Notes: 1. The system still responds to ARP and/or ping requests for the IP address of this virtual server. 2. As the virtual server is still configured in the system, you can enable the virtual server using ###enable vserver### command.
Example disable vserver lb_vip To disable multiple vservers at once use the following command: disable vserver lb_vip[1-3] Related Commands add lb vserver rm lb vserver set lb vserver unset lb vserver enable lb vserver show lb vserver stat lb vserver rename lb vserver
show lb vserver
Synopsis show lb vserver [<name>] show lb vserver stats - alias for 'stat lb vserver' Description Display load balancing virtual servers information. Arguments name The name of the load balancing server. If no load balancing virtual server name is entered, a list of all configured load balancing virtual servers is displayed. All the services and priority queuing/ SureConnect policies that are bound to this virtual server are also displayed. summary fullValues format level insertVserverIPPort The virtual IP and port header insertion option for the vserver. vipHeader The name of virtual IP and port header. value SSL status. stateflag appfwPolicyFlag IPAddress The IP address of the virtual server. IPAddress The IP address of the virtual server. IPPattern
The IP pattern of the virtual server. IPMask The IP address mask of the virtual server. Listenpolicy The string is listenpolicy configured for lb vserver Listenpriority This parameter is the priority for listen policy of LB Vserver. IPMapping The permanent mapping for the V6 Address port A port number for the virtual server. range The IP range for the network vserver. serviceType The service type. type Type of LB vserver. state Current LB vserver state. effectiveState Effective state of the LB vserver , based on the state of backup vservers. status Current status of the lb vserver. During the initial phase if the configured lb method is not round robin , the vserver will adopt round robin to distribute traffic for a predefined number of requests. lbrrreason Reason why a vserver is in RR. The following are the reasons: 1 - MEP is DOWN (GSLB) 2 LB method has changed 3 - Bound service's state changed to UP 4 - A new service is bound 5 Startup RR factor has changed 6 - LB feature is enabled 7 - Load monitor is not active on a service 8 - Vserver is Enabled 9 - SSL feature is Enabled 10 - All bound services have reached threshold. Using effective state to load balance (GSLB) 11 - Primary state of bound services are not UP. Using effective state to load balance (GSLB) 12 - No LB decision can be made as all bound services have either reached threshold or are not UP (GSLB) 13 - All load monitors are active cacheType Cache type. redirect Cache redirect type. precedence Precedence. redirectURL The redirect URL. Authentication Authentication. authn401 HTTP 401 response based authentication.
authnVsName Name of authentication vserver homePage Home page. dnsVserverName DNS vserver name. domain Domain. policyName Name of the policy bound to the LB vserver. serviceName The service name bound to the selected load balancing virtual server. serviceGroupName The service group name bound to the selected load balancing virtual server. weight The weight for the specified service. dynamicWeight Dynamic weight cacheVserver Cache virtual server. backupVServer The Backup Virtual Server. priority Priority. cltTimeout The client timeout in seconds. soMethod The spillover method to be in effect. soPersistence State of spillover persistence. soPersistenceTimeOut The maximum time persistence is in effect for a specific client on a spillover vserver. soThreshold In case of CONNECTION (or) DYNAMICCONNECTION type spillover method this value is treated as Maximum number of connections an lb vserver will handle before spillover takes place. In case of BANDWIDTH type spillover method this value is treated as the amount of incoming and outgoing traffic (in Kbps) a Vserver will handle before spillover takes place. In case of HEALTH type spillover method if the percentage of active services (by weight) becomes lower than this value, spillover takes place lbMethod The load balancing method to be in effect hashLength The hash length.
dataOffset The data offset length for TOKEN load balancing method. health Health of vserver based on percentage of weights of active svcs/all svcs. This does not consider administratively disabled svcs dataLength The data length for TOKEN load balancing method. netmask The netmask of the destination network. v6netmasklen The netmask of the destination network. rule Rule type. resRule Use this parameter to specify the expression to be used in response for RULE persistence type. The string is an in-line expression with a maximum of 1499 characters. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. ruleType Rule type. groupName LB group to which the lb vserver is to be bound. m The LB mode. tosId TOS ID persistenceType The persistence type for the specified virtual server timeout The maximum time persistence is in effect for a specific client. cookieDomain Domain name to be used in the set cookie header in case of cookie persistence. persistMask The persistence mask for v4 traffic v6persistmasklen The persistence mask for v6 traffic. persistenceBackup The maximum time backup persistence is in effect for a specific client. backupPersistenceTimeout The maximum time backup persistence is in effect for a specific client. cacheable The state of caching.
pq The state of priority queuing on the specified virtual server. sc The state of SureConnect the specified virtual server. rtspNat Use this parameter to enable natting for RTSP data connection. sessionless To enable sessionless load balancing, enable this option map Map. connfailover The connection failover mode of the virtual server redirectPortRewrite The state of port rewrite while performing HTTP redirect. downStateFlush Perform delayed clean up of connections on this vserver. disablePrimaryOnDown Tells whether traffic will continue reaching backup vservers even after primary comes UP from DOWN state. gt2GB Allow for greater than 2 GB transactions on this vserver. thresholdValue Tells whether threshold exceeded for this service participating in CUSTOMLB type The bindpoint to which the policy is bound invoke Invoke flag. labelType The invocation type. labelName Name of the label invoked. cookieIpPort Encryped Ip address and port of the service that is inserted into the set-cookie http header vserverId Vserver Id version Cookie version totalServices Total number of services bound to the vserver. activeServices Total number of active services bound to the vserver. stateChangeTimeSec
Time when last state change happened. Seconds part. stateChangeTimeSeconds Time when last state change happened. Seconds part. stateChangeTimemSec Time at which last state change happened. Milliseconds part. ticksSinceLastStateChange Time in 10 millisecond ticks since the last state change. hits Number of hits. AuthenticationHost FQDN of authentication vserver push Process traffic on bound Push vserver. pushVserver The lb vserver of type PUSH/SSL_PUSH to which server pushes the updates received on the client facing non-push lb vserver. pushLabel Use this parameter to specify the expression to extract the label in response from server. The string can be either a named expression (configured using add policy expression command) or else it can be an in-line expression with a maximum of 63 characters. pushMultiClients Specify if multiple web 2.0 connections from the same client can connect to this vserver and expect updates. tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment Comments associated with this virtual server. flag flags policySubType l2Conn Use L2 Parameters to identify a connection mssqlServerVersion The version of the MSSQL server mysqlProtocolVersion The protocol version returned by the mysql vserver. mysqlServerVersion The server version string returned by the mysql vserver. mysqlCharacterSet The character set returned by the mysql vserver.
mysqlServerCapabilities The server capabilities returned by the mysql vserver. appflowLog Enable logging appflow flow information netProfile The name of the network profile. isGslb This field is set to true if it is a GSLBVserver. icmpVsrResponse Can be active or passive newServiceRequest The number of requests/sec or percentage of requests/sec a new service should receive compared to the existing services. The maximum possible value for requests/sec is 65536 and percentage of requests is 100 newServiceRequestUnit The unit for new service request value newServiceRequestIncrementInterval The interval in seconds after which the new services requests limit should be automatically increased. count Example Related Commands add lb vserver rm lb vserver set lb vserver unset lb vserver enable lb vserver disable lb vserver stat lb vserver rename lb vserver
stat lb vserver
Synopsis stat lb vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] [-sortBy [<sortOrder>]] Description Display load-balancing vserver statistics. Arguments name The name of the vserver for which statistics will be displayed. If not given statistics are shown for all vservers.
sortBy count devno stateflag Current Client Est connections (ClntEstConn) Number of client connections in ESTABLISHED state. Vserver Health (Health) Health of the vserver. This gives percentage of UP services bound to this vserver. Vserver IP address (vsvrIP) IP address of the vserver Port (port) The port on which the service is running. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Vserver hits (Hits) Total vserver hits Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Total Packets rcvd (PktRx) Total number of packets received by this service or virtual server. Total Packets sent (PktTx) Total number of packets sent. Current client connections (ClntConn) Number of current client connections. Current server connections (SvrConn) Number of current connections to the actual servers behind the virtual server. Spill Over Threshold (SOThresh) Spill Over Threshold set on the VServer. Spill Over Hits (NumSo ) Number of times vserver expereinced spill over. Labeled Connection (LblConn) Number of Labeled connection on this vserver
Push Labeled Connection (PushLbl) Number of labels for this push vserver. Deferred Request (DefReq) Number of deferred request on this vserver Invalid Request/Response (IvldReqRsp) Number invalid requests/responses on this vserver Invalid Request/Response Dropped (IvldReqRspDrp) Number invalid requests/responses dropped on this vserver Current Server Est connections (SvrEstConn) Number of server connections in ESTABLISHED state. Example
Related Commands add lb vserver rm lb vserver set lb vserver unset lb vserver enable lb vserver disable lb vserver show lb vserver rename lb vserver
rename lb vserver
Synopsis rename lb vserver <name>@ <newName>@ Description Rename a load balancing virtual server. Arguments name The name of the load balancing virtual server. newName The new name of the virtual server. Example rename lb vserver http_vsvr http_vsvr_new Related Commands add lb vserver rm lb vserver
set lb vserver unset lb vserver enable lb vserver disable lb vserver show lb vserver stat lb vserver
add lb metricTable
Synopsis add lb metricTable <metricTable> Description Use this command to add a metric table. Arguments metricTable The name of the metric table. Example add metrictable newtable
Related Commands rm lb metricTable set lb metricTable bind lb metricTable unbind lb metricTable show lb metricTable
rm lb metricTable
Synopsis rm lb metricTable <metricTable> Description Use this command to remove a metric table. Arguments metricTable The name of the metric table. Example rm metric table netscaler
Related Commands add lb metricTable set lb metricTable bind lb metricTable unbind lb metricTable show lb metricTable
set lb metricTable
Synopsis set lb metricTable <metricTable> <metric> <snmpOID> Description Use this command to set a metric table. Arguments metricTable The name of the metric table. Example set metrictable table met1 aliasname oidstr Related Commands add lb metricTable rm lb metricTable bind lb metricTable unbind lb metricTable show lb metricTable
bind lb metricTable
Synopsis bind lb metricTable <metricTable> <metric> <snmpOID> Description Use this command to bind metric and OID to the metrictable. Arguments metricTable The name of the metric table. metric metric name of the oid. Example bind metrictable tablename aliasname 1.2.3.4
Related Commands add lb metricTable rm lb metricTable set lb metricTable unbind lb metricTable show lb metricTable
unbind lb metricTable
Synopsis unbind lb metricTable <metricTable> <metric> Description Use this command to unbind metric from the metrictable. Arguments metricTable The name of the metric table. metric Metric name from the table that has to be unbound. Example unbind metrictable tablename aliasname
Related Commands add lb metricTable rm lb metricTable set lb metricTable bind lb metricTable show lb metricTable
show lb metricTable
Synopsis show lb metricTable [<metricTable>] Description Display the parameters for the specified metrictable. If the metrictablename argument is not specified, a list of all existing metrictable is returned. Arguments metricTable The name of the metric table.
summary fullValues format level metric Metric name of the oid. snmpOID OID corresponding to the metric flags flags controlling display stateflag flags controlling display metricType Indication if it is a configured or internal count Example An example of the show metrictable command output is as follows: Name : ALTEON Type : INTERNAL Name : CISCO-CSS Type : INTERNAL Name : FOUNDRY Type : INTERNAL Name : NETSCALER Type : INTERNAL Name : F5 Type : INTERNAL Name : local Type : INTERNAL
Related Commands add lb metricTable rm lb metricTable set lb metricTable bind lb metricTable unbind lb metricTable
add lb wlm
Synopsis
Description Add a Work Load Manager. NOTE: This command is deprecated.WLM feature has been deprecated from Kos onwards as classic build is not supported. Arguments wlmName The name of the Work Load Manager. IPAddress The IP address of the WLM.
LBUID The LBUID for the Load Balancer to communicate to the Work Load Manager. KATimeout The idle time period after which NS would probe the WLM. The value ranges from 1 to 1440 minutes. Default value: 2 Maximum value: 1440 Example add lb wlm ibm_wlm 10.102.1.10 3060
Related Commands rm lb wlm set lb wlm unset lb wlm show lb wlm
rm lb wlm
Synopsis
Description Removes a Work Load Manager. NOTE: This command is deprecated.WLM feature has been deprecated from Kos onwards as classic build is not supported. Arguments wlmName The name of the Work Load Manager to be removed. Example rm lb wlm ibm_wlm
Related Commands add lb wlm set lb wlm unset lb wlm show lb wlm
set lb wlm
Synopsis
Description set Work Load Manager attributes NOTE: This command is deprecated.
Arguments wlmName The name of the work load manager. KATimeout The idle time period after which NS would probe the WLM. The value ranges from 1 to 1440 minutes. Default value: 2 Maximum value: 1440 Example set lb wlm ibm_wlm -ka_timeout 6
Related Commands add lb wlm rm lb wlm unset lb wlm show lb wlm
unset lb wlm
Synopsis
Description Use this command to remove lb wlm settings.Refer to the set lb wlm command for meanings of the arguments.NOTE: This command is deprecated. Arguments Example
Related Commands add lb wlm rm lb wlm set lb wlm show lb wlm
show lb wlm
Synopsis
Description show Work Load Manager details NOTE: This command is deprecated.WLM feature has been deprecated from Kos onwards as classic build is not supported.
Arguments wlmName The name of the work load manager. summary fullValues format level IPAddress The IP address of the WLM. port A port number for the virtual server. stateflag secure Use this parameter to enable secure mode of communication with WLM. KATimeout The idle time period after which NS would probe the WLM. The value ranges from 1 to 1440 minutes. LBUID The LBUID for the Load Balancer to communicate to the Work Load Manager. state State of the WLM. vServerName Name of the virtual server which is to be bound to the WLM. count Example show lb wlm ibm_wlm
Related Commands add lb wlm rm lb wlm set lb wlm unset lb wlm
bind lb wlm
Synopsis
Description Bind a vserver to Work Load Manager. NOTE: This command is deprecated.WLM feature has been deprecated from Kos onwards as classic build is not supported.
Arguments wlmName The name of the Work Load Manager. vServerName Name of the virtual server which is to be bound to the WLM. Example bind lb wlm ibm_wlm http_vip To bind multiple vservers to workload manager use the following command: bind lb wlm ibm_wlm http_vip[1-3]
Related Commands unbind lb wlm
unbind lb wlm
Synopsis
Description Unbind a vserver from Work Load Manager. NOTE: This command is deprecated.WLM feature has been deprecated from Kos onwards as classic build is not supported. Arguments wlmName The name of the Work Load Manager. vServerName Name of the virtual server which is to be unbound from the WLM. Example unbind lb wlm ibm_wlm http_vip To unbind multiple vservers from Work Load Manager use the following command: unbind lb wlm ibm_wlm http_vip[1-3]
Related Commands bind lb wlm
show lb monbindings
Synopsis show lb monbindings <monitorName> Description Display the services to which this monitor is bound Arguments monitorName The name of the monitor.
summary fullValues type The type of monitor. state The state of the monitor. boundServiceGroupSvrState The state of the servicegroup. monsvcState The configured state (enable/disable) of Monitor on this service. monState The configured state (enable/disable) of Monitor on this service. IPAddress The IPAddress of the service. port The port of the service. serviceName The name of the service. serviceGroupName The name of the service group. serviceType The type of service svrState The state of the service stateflag count Example
Related Commands
show lb persistentSessions
Synopsis show lb persistentSessions [<vServer>] Description Get all vserver persistent sessions Arguments vServer The name of the virtual server.
summary fullValues type The netmask of this IP. srcIP SOURCE IP. srcIPv6 SOURCE IPv6 ADDRESS. destIP DESTINATION IP. destIPv6 DESTINATION IPv6 ADDRESS. flags IPv6 FLAGS. destPort Destination port. vServerName Virtual server name. timeout Persistent Session timeout. referenceCount Reference Count. sipCallID SIP CALLID. persistenceParam Specific persistence information . Callid in case of SIP_CALLID persistence entry , RTSP session id in case of RTSP_SESSIONID persistence entry. count stateflag Example
Related Commands clear lb persistentSessions
clear lb persistentSessions
Synopsis clear lb persistentSessions [<vServer>] Description Use this command to clear/flush persistent sessions
Arguments vServer The name of the LB vserver whose persistence sessions are to be flushed. If not specified, all persistence sessions will be flushed . Example
Related Commands show lb persistentSessions
set lb group
Synopsis set lb group <name>@ [-persistenceType <persistenceType>] [-persistenceBackup ( SOURCEIP | NONE )] [-backupPersistenceTimeout <mins>] [-persistMask <netmask>] [-v6persistmasklen <positive_integer>] [cookieDomain <string>] [-timeout <mins>] [-rule <expression>] Description Set the persistence for the group (used in the system's load balancing feature). Persistence is set for the connections between a client and a server that is being load balanced by the system. The client will be directed to the same server until client's transactions have completed (or until the time period that you have specified has passed). Before using this command, the group must be created. The group is created implicitly when binding a load balancing virtual server to a group using the bind lb group CLI command. Similarly a group is removed when the last load balancing virtual server is unbound from it using the unbind lb group CLI command. Arguments name The name of the group. persistenceType The persistence type for the group. Select SOURCEIP - This option is used to maintain persistency based on the client IP. COOKIEINSERT- This option is used to maintain persistency based on the cookie in the client request.This cookie is inserted by the system in the first response to the client. NONE - To disable the persistency. Possible values: SOURCEIP, COOKIEINSERT, RULE, NONE persistenceBackup The backup persistence type for the group. Possible values: SOURCEIP, NONE backupPersistenceTimeout The maximum time backup persistence is in effect for a specific client. Default value: 2 Minimum value: 2 Maximum value: 1440 persistMask The netmask to be applied when the persistency type is SOURCEIP. Default value: 0xFFFFFFFF v6persistmasklen The persistence mask. Use this parameter if you are using IPv6 based persistence type on an lb group Default value: 128 Minimum value: 1 Maximum value: 128 cookieDomain The domain attribute of the HTTP cookie. timeout The maximum time that persistence is in effect for a specific client. Default value: 2 Maximum value: 1440
rule The RULE persistence type. The string can be either a existing rule name (configured using ###add rule### command) or else it could it be an inline expression with a maximum of 1500 characters. Default value: "None" Example set lb group webgrp -persistenceType COOKIEINSERT To set the persistence type for multiple groups use the following command: set lb group webgrp[1-3] -persistenceType COOKIEINSERT
Related Commands unset lb group bind lb group unbind lb group show lb group rename lb group
unset lb group
Synopsis unset lb group <name>@ [-persistenceType] [-persistenceBackup] [-backupPersistenceTimeout] [-persistMask] [v6persistmasklen] [-cookieDomain] [-timeout] [-rule] Description Use this command to remove lb group settings.Refer to the set lb group command for meanings of the arguments. Arguments Example
Related Commands set lb group bind lb group unbind lb group show lb group rename lb group
bind lb group
Synopsis bind lb group <name>@ <vServerName>@ ... Description Create a group of virtual servers in the system. This group supports server persistence. Only address-based (not content-based) virtual servers can be added to a group. Each virtual server can only be assigned to one group. When
moving a virtual server from one group to another, the virtual server must be removed from the original group with the unbind lb group command. Arguments name The name of the group. A maximum of 127 characters can be used to specify a new name to a group of virtual servers that you are creating (or to specify an existing group name if you are adding the virtual server to an existing group of virtual servers. vServerName The name of the virtual server that will belong to the named group. Example bind lb group webgrp http_vip To bind multiple vservers to a group use the following command: bind lb group webgrp v[1-4] To bind vserver v1 to group webgrp1, v2 to webgrp2 and v3 to webgrp3, use the following command: bind lb group webgrp[1-3] v[1-3]
Related Commands set lb group unset lb group unbind lb group show lb group rename lb group
unbind lb group
Synopsis unbind lb group <name> <vServerName>@ ... Description Unbind the virtual server from a group. When the last vserver is unbound, the group is deleted from system. Arguments name The name of the group. vServerName The name of the virtual server to be removed from the group. Multiple names can be specified. Example unbind lb group webgroup http_vip To unbind multiple vservers use the following command: unbind lb group webgroup v[1-3]
Related Commands set lb group unset lb group bind lb group
show lb group rename lb group
show lb group
Synopsis show lb group [<name>] Description Display the names of the virtual servers associated to the specified group. The virtual servers were created using the ###add vserver### command. Arguments name The name of the group . summary fullValues format level vServerName Virtual server name. persistenceType The type of the persistence set for the group. persistenceBackup The type of the backup persistence set for the group. backupPersistenceTimeout The maximum time backup persistence is in effect for a specific client. persistMask The netmask applied for ipv4 traffic when the persistency type is SOURCEIP. v6persistmasklen The netmask applied for ipv6 traffic when the persistency type is SOURCEIP. cookieDomain The domain attribute of the HTTP cookie. timeout The maximum time that persistence is in effect for a specific client. rule Rule type. stateflag count Example show lb group webgrp
Related Commands set lb group unset lb group bind lb group unbind lb group rename lb group
rename lb group
Synopsis rename lb group <name>@ <newName>@ Description Rename a load balancing virtual server group. Arguments name The name of the load balancing virtual server group. newName The new name of the virtual server group. Example rename lb group gv1 gv-new1
Related Commands set lb group unset lb group bind lb group unbind lb group show lb group
set lb sipParameters
Synopsis set lb sipParameters [-rnatSrcPort <port>] [-rnatDstPort <port>] [-retryDur <integer>] [-addRportVip ( ENABLED | DISABLED )] [-sip503RateThreshold <positive_integer>] Description Set different SIP parameters Arguments rnatSrcPort In the rnat path if the sip packet has the src port matching this port configured by the user, we will do SIP processing on it like creating persistence sessions and appending the rport. rnatDstPort
In the rnat path if the sip packet has the dst port matching this port configured by the user, we will do SIP processing on it like creating persistence sessions and appending the rport. retryDur When the 503 message is generated we will inform the client to retry after X seconds which is specified by retryDur. Default value: 120 Minimum value: 1 addRportVip Add rport to SIP requests coming on VIP Possible values: ENABLED, DISABLED Default value: ENABLED sip503RateThreshold If the sip vserver is down we will send the send a 503 message indicating that the service is unavailable. The variable will govern the number of messages we will generate per 10ms Default value: 100 Example set sip parameter Related Commands unset lb sipParameters show lb sipParameters
unset lb sipParameters
Synopsis unset lb sipParameters [-rnatSrcPort] [-rnatDstPort] [-retryDur] [-addRportVip] [-sip503RateThreshold] Description Use this command to remove lb sipParameters settings.Refer to the set lb sipParameters command for meanings of the arguments. Arguments Example
Related Commands set lb sipParameters show lb sipParameters
show lb sipParameters
Synopsis show lb sipParameters Description Display the SIP parameters Arguments format
level rnatSrcPort In the rnat path if the sip packet has the src port matching this port configured by the user, we will do SIP processing on it like creating persistence sessions and appending the rport. rnatDstPort In the rnat path if the sip packet has the dst port matching this port configured by the user, we will do SIP processing on it like creating persistence sessions and appending the rport. retryDur When the 503 message is generated we will inform the client to retry after X seconds which is specified by retryDur. addRportVip Add rport to SIP requests coming on VIP sip503RateThreshold If the sip vserver is down we will send the send a 503 message indicating that the service is unavailable. The variable will govern the number of messages we will generate per 10ms Example show sip parameter Related Commands set lb sipParameters unset lb sipParameters
set lb parameter
Synopsis set lb parameter [-httpOnlyCookieFlag ( ENABLED | DISABLED )] [-consolidatedLConn ( YES | NO )] [usePortForHashLb ( YES | NO )] [-preferDirectRoute ( YES | NO )] [-startupRRFactor <positive_integer>] [-monitorSkipMaxClient ( ENABLED | DISABLED )] [-monitorConnectionClose ( RESET | FIN )] [vServerSpecificMac ( ENABLED | DISABLED )] Description Set a common LB parameter Arguments httpOnlyCookieFlag enable/disable httponly flag for persistence cookie Possible values: ENABLED, DISABLED Default value: ENABLED consolidatedLConn Indicates whether use consolidate stats to find the least connection service. Possible values: YES, NO Default value: YES usePortForHashLb Indicates whether to consider port of the service for hash based lb methods. Possible values: YES, NO Default value: YES preferDirectRoute If enabled, will do route lookup incase of wildcard server Possible values: YES, NO Default value: YES
startupRRFactor Factor used to decide the number of requests the vserver will be serving in Round Robin mode, before switching to configured LB method monitorSkipMaxClient Enabling this option will skip maxClients limit check for monitoring connections Possible values: ENABLED, DISABLED Default value: DISABLED monitorConnectionClose This option is used to control the way the monitoring connections will be closed, either by FIN or RST . Default is FIN Possible values: RESET, FIN Default value: FIN vServerSpecificMac Incase of FW LB deployments, we might want that the return traffic from firewall should be send to another FW. NS defualt behavior is that we never reload balance the trafic returned from the services. However turning this knob ON, it willl make sure that NS lets other mac mode LB vserver to pick up this return traffic. The loop however is avoided as we dont pick the same vserver again Possible values: ENABLED, DISABLED Default value: DISABLED Example set lb parameter -httponly (ENABLED|DISABLED)
Related Commands unset lb parameter show lb parameter
unset lb parameter
Synopsis unset lb parameter [-httpOnlyCookieFlag] [-consolidatedLConn] [-usePortForHashLb] [-preferDirectRoute] [startupRRFactor] [-monitorSkipMaxClient] [-monitorConnectionClose] [-vServerSpecificMac] Description Use this command to remove lb parameter settings.Refer to the set lb parameter command for meanings of the arguments. Arguments Example
Related Commands set lb parameter show lb parameter
show lb parameter
Synopsis show lb parameter
Description Show LB parameters Arguments format level httpOnlyCookieFlag enable/disable httponly flag for persistence cookie consolidatedLConn Indicates whether use consolidate stats to find the least connection service. usePortForHashLb Indicates whether to consider port of the service for hash based lb methods. preferDirectRoute If enabled, will do route lookup incase of wildcard server startupRRFactor Used to change the factor of service hits after which vserver will come out of slowstart phase. monitorSkipMaxClient Enabling this option will skip maxClients limit check for monitoring connections monitorConnectionClose This option is used to control the way the monitoring connections will be closed, either by FIN or RST . Default is FIN vServerSpecificMac Incase of FW LB deployments, we might want that the return traffic from firewall should be send to another FW. NS defualt behavior is that we never reload balance the trafic returned from the services. However turning this knob ON, it willl make sure that NS lets other mac mode LB vserver to pick up this return traffic. The loop however is avoided as we dont pick the same vserver again Example show lb parameter
Related Commands set lb parameter unset lb parameter
Chapter
26
Network commands
Topics: add arp rm arp send arp show arp add channel rm channel set channel unset channel bind channel unbind channel show channel add fis rm fis bind fis unbind fis show fis add route clear route rm route set route unset route show route add vlan rm vlan set vlan unset vlan bind vlan unbind vlan show vlan stat vlan add vrID rm vrID set vrID unset vrID bind vrID unbind vrID
700 | Citrix NetScaler 10 | Network commands
show vrID add vrID6 rm vrID6 bind vrID6 unbind vrID6 show vrID6 add route6 clear route6 rm route6 set route6 unset route6 show route6 add nd6 clear nd6 rm nd6 show nd6 add inat rm inat set inat unset inat show inat add bridgegroup rm bridgegroup set bridgegroup unset bridgegroup bind bridgegroup unbind bridgegroup show bridgegroup add ipTunnel rm ipTunnel show ipTunnel add ip6Tunnel rm ip6Tunnel show ip6Tunnel add netbridge rm netbridge show netbridge bind netbridge unbind netbridge add ipset rm ipset bind ipset unbind ipset show ipset add linkset rm linkset bind linkset unbind linkset
Citrix NetScaler 10 | Network commands | 701
show linkset add netProfile rm netProfile set netProfile unset netProfile show netProfile set arpparam unset arpparam show arpparam show ci clear interface set interface unset interface enable interface disable interface reset interface show interface stat interface clear rnat set rnat unset rnat stat rnat show rnat set bridgetable unset bridgetable show bridgetable clear bridgetable stat bridge set lacp show lacp set rnatparam unset rnatparam show rnatparam stat rnatip set vrIDParam unset vrIDParam show vrIDParam set ipv6 unset ipv6 show ipv6 set ipTunnelParam unset ipTunnelParam show ipTunnelParam set ip6TunnelParam unset ip6TunnelParam show ip6TunnelParam set L2Param unset L2Param
show L2Param set L3Param unset L3Param show L3Param add forwardingSession set forwardingSession rm forwardingSession show forwardingSession add rnat6 bind rnat6 unbind rnat6 set rnat6 unset rnat6 clear rnat6 show rnat6
add arp
Synopsis add arp -IPAddress <ip_addr> -mac <mac_addr> -ifnum <interface_name> Description Add a static entry to the appliance's ARP table. This ARP entry never times out. Arguments IPAddress IP address of the network device that you want to add to the ARP table. mac MAC address of a network device for the ARP entry. ifnum The Interface through which the network device is accessible. The format for specifying the interface is in slot/port notation (for example, 1/3). Example add arp -ip 10.100.0.48 -mac 00:a0:cc:5f:76:3a -ifnum 1/1 Related Commands rm arp send arp show arp
rm arp
Synopsis rm arp (<IPAddress> | -all) Description Remove an entry from the appliance's ARP table. Arguments IPAddress IP address of the network device specified in the ARP entry that you want to remove from the ARP table. all Remove all ARP entries from the ARP table of the NetScaler appliance. Example
Related Commands add arp send arp show arp
send arp
Synopsis send arp (<IPAddress> | -all) Description Send Gratuitous Address Resolution Protocol (GARP) messages for the specified NetScaler owned IP addresses. Arguments IPAddress A NetScaler owned IP address for which the NetScaler appliance sends Gratuitous Address Resolution Protocol (GARP) messages. all Send Gratuitous Address Resolution Protocol (GARP) messages for all NetScaler owned IP addresses on which the ARP option is enabled. If you set this option in a high availability configuration, the node sends GARP messages for only the NSIP address. Example send arp 10.10.10.10 Related Commands add arp rm arp show arp
show arp
Synopsis show arp [<IPAddress>] Description Display all the entries in the system's ARP table. Arguments IPAddress The IP address corresponding to an ARP entry. summary fullValues format level mac The MAC address corresponding to an ARP entry. ifnum The interface on which this MAC address resides. timeout The time, in seconds, after which the entry times out. state The state of the ARP entry.
flags The flags for the entry. type Indicates whether this ARP entry was added manually or dynamically. When you manually add an ARP entry, the value for this parameter is STATIC. Otherwise, it is DYNAMIC. For the NSIP and loopback IP addresses, the value is PERMANENT. vlan The VLAN ID through which packets are to be sent after matching the ARP entry. This is a numeric value. channel The tunnel, channel, or physical interface through which the ARP entry is identified. count stateflag Example The output of the sh arp command is as follows: 5 configured arps: IP MAC Inface VLAN Origin TTL ------- ------- ------- ------ ------- -------- 1) 10.250.11.1 00:04:76:dc:f1:b9 1/2 2 dynamic 700 2) 10.11.0.254 00:30:19:c1:7e:f4 1/1 1 dynamic 500 3) 10.11.0.41 00:d0:a8:00:7c:e4 0/1 1 dynamic 500 4) 10.11.222.2 00:ee:ff:22:00:01 0/1 1 dynamic 500 5) 10.11.201.12 00:30:48:31:23:49 0/1 1 dynamic 500 Related Commands add arp rm arp send arp
add channel
Synopsis add channel <id> [-ifnum <interface_name> ...] [-state ( ENABLED | DISABLED )] [-speed <speed>] [-flowControl <flowControl>] [-haMonitor ( ON | OFF )] [-tagall ( ON | OFF )] [-ifAlias <string>] [-throughput <positive_integer>] [-bandwidthHigh <positive_integer> [-bandwidthNormal <positive_integer>]] Description Add a link aggregate channel. Arguments id LA channel name (in form LA/* or CLA/* for Cluster LA) ifnum The interfaces to be bound to Link Aggregate channel. state The initial state for the LA channel. Possible values: ENABLED, DISABLED Default value: NSA_DVC_ENABLE Mode The initital mode for the LA channel. Possible values: MANUAL, AUTO connDistr The 'connection' distribution mode for the LA channel. Possible values: DISABLED, ENABLED
macdistr The 'MAC' distribution mode for the LA channel. Possible values: SOURCE, DESTINATION, BOTH speed The speed for the LA channel. Possible values: AUTO, 10, 100, 1000, 10000 Default value: NSA_DVC_SPEED_AUTO flowControl Flow control for the LA channel. Possible values: OFF, RX, TX, RXTX Default value: NSA_DVC_FC_OFF haMonitor HA monitoring for the LA channel. Possible values: ON, OFF Default value: NSA_DVC_MONITOR_ON tagall The appliance adds a four-byte 802.1q tag to every packet sent on this channel. ON applies tags for all the VLANs that are bound to this channel. OFF, applies the tag for all VLANs other than the native VLAN. Possible values: ON, OFF Default value: NSA_DVC_VTRUNK_OFF trunk This is deprecated by tagall Possible values: ON, OFF Default value: OFF ifAlias The alias name for the channel. Default value: " " throughput Minimum required throughput for the interface. bandwidthHigh High threshold, in Mbps, for bandwidth usage by the interface. A trap is sent if bandwidth usage by the interface crosses this limit. Example Related Commands rm channel set channel unset channel bind channel unbind channel show channel
rm channel
Synopsis rm channel <id> Description Remove the specified link aggregate channel from the appliance. Arguments id LA channel name (in form LA/* or CLA/* for Cluster LA)
Example
Related Commands add channel set channel unset channel bind channel unbind channel show channel
set channel
Synopsis set channel <id> [-state ( ENABLED | DISABLED )] [-speed <speed>] [-flowControl <flowControl>] [-haMonitor ( ON | OFF )] [-tagall ( ON | OFF )] [-ifAlias <string>] [-throughput <positive_integer>] [-bandwidthHigh <positive_integer> [-bandwidthNormal <positive_integer>]] Description Modify the settings of an existing channel Arguments id LA channel name (in form LA/* or CLA/* for Cluster LA) state The packet processing state for the LA channel. Possible values: ENABLED, DISABLED Default value: NSA_DVC_ENABLE Mode The mode for the LA channel. Possible values: MANUAL, AUTO connDistr The 'connection' distribution mode for the LA channel. Possible values: DISABLED, ENABLED macdistr The 'MAC' distribution mode for the LA channel. Possible values: SOURCE, DESTINATION, BOTH speed The speed for the LA channel. Possible values: AUTO, 10, 100, 1000, 10000 Default value: NSA_DVC_SPEED_AUTO flowControl Required flow control for the LA channel. Possible values: OFF, RX, TX, RXTX Default value: NSA_DVC_FC_OFF haMonitor The state of HA monitoring for the LA channel. Possible values: ON, OFF Default value: NSA_DVC_MONITOR_ON tagall The appliance adds a four-byte 802.1q tag to every packet sent on this channel. ON applies tags for all the VLANs that are bound to this channel. OFF, applies the tag for all VLANs other than the native VLAN. Possible values: ON, OFF Default value: NSA_DVC_VTRUNK_OFF
trunk This is deprecated by tagall. Possible values: ON, OFF Default value: OFF ifAlias The alias name for the interface. Default value: " " throughput Minimum required throughput for the interface. bandwidthHigh High threshold, in Mbps, for bandwidth usage by the interface. A trap is sent if bandwidth usage by the interface crosses this limit. Example
Related Commands add channel rm channel unset channel bind channel unbind channel show channel
unset channel
Synopsis unset channel <id> [-state] [-speed] [-flowControl] [-haMonitor] [-tagall] [-ifAlias] [-throughput] [-bandwidthHigh] [-bandwidthNormal] Description Use this command to remove channel settings.Refer to the set channel command for meanings of the arguments. Arguments Example
Related Commands add channel rm channel set channel bind channel unbind channel show channel
bind channel
Synopsis bind channel <id> <ifnum> ...
Description Bind the specified physical interface to the link aggregate channel. Arguments id LA channel name (in form LA/* or CLA/* for Cluster LA) ifnum Interfaces to be bound to the LA channel. Example Related Commands add channel rm channel set channel unset channel unbind channel show channel
unbind channel
Synopsis unbind channel <id> <ifnum> ... Description Unbind the specified interfaces from the link aggregate channel. Arguments id LA channel name (in form LA/* or CLA/* for Cluster LA) ifnum Interfaces to be unbound from the LA channel. Example Related Commands add channel rm channel set channel unset channel bind channel show channel
show channel
Synopsis show channel [<id>]
Description Display all the settings for a link aggregate channel (for example, slave interfaces and VLAN settings). If no channel ID is specified, a subset of the settings, pertaining to all the channels, is displayed. Arguments id LA channel name in form LA/x, where x is the channel ID, which ranges from 1 to 4. Minimum value: 1 summary fullValues format level stateflag deviceName LA channel name in form LA/x, where x is channel ID, which ranges from 1 to 4. unit Unit number of the channel. This is an internal reference number that the NetScaler uses to identify the channel. description The IEEE standard that the channel is based on. flags Flags of this channel. mtu MTU of the channel. This is the maximum frame size that the channel can process. vlan Native VLAN of the channel. mac MAC address of the channel. uptime Duration for which the channel is UP. (Example: 3 hours 1 minute 1 second). This value is reset when the channel state changes to DOWN. downTime Duration for which the channel is DOWN. (Example: 3 hours 1 minute 1 second). This value is reset when the channel state changes to UP. reqMedia Requested media setting for this channel. Since there is no media associated with LA, the displayed values carry no significance. reqSpeed Requested speed setting for this channel. Since no media are associated with LA, this speed is used to determine the threshold for the slave interfaces. If the speed of the member interface is less than the requested speed, that interface is considered inactive. reqDuplex Requested duplex setting for this channel. Since no media are associated with LA, the displayed values carry no significance. reqFlowcontrol
Requested flow control setting for this channel. Since no media are associated with LA, the displayed values carry no significance. media Actual media setting for this channel. speed The speed for the LA channel. duplex Actual duplex setting for this channel. flowControl Flow control for the LA channel. media Requested media setting for this interface. speed Actual speed setting for this channel. duplex Actualduplex setting for this interface. flowControl Actual flow control setting for this channel. connDistr Connection distribution setting on this Channel. macdistr MAC distribution setting on this Channel. Mode The type of LA: static LA or dynamic LA (LACP). Possible values: Manual, AUTO. Manual shows the static LA, and AUTO shows the LACP. haMonitor HA monitoring enabled or disabled for this channel. state The initial state for the LA channel. autoneg Requested auto negotiation setting for this channel. Since no media are associated with LA, this setting has no effect. autonegResult Actual auto negotiation setting for this channel. tagged VLAN tags setting on this channel. tagall The appliance adds a four-byte 802.1q tag to every packet sent on this channel. ON applies tags for all the VLANs that are bound to this channel. OFF, applies the tag for all VLANs other than the native VLAN. trunk This is deprecated by tagall taggedAny
Channel setting to accept/drop all tagged packets. taggedAutolearn Dynaminc vlan membership on this channel. hangDetect Hang detect for this channel. hangReset Hang reset for this channel. rxpackets Number of bytes received by all the slave interfaces of the channel since the NetScaler appliance was started or the interface statistics were cleared. rxbytes Number of packets received by all member interfaces since the NetScaler appliance was started or the interface statistics were cleared. rxerrors Number of inbound packets dropped by the hardware of the slave interfaces since the NetScaler appliance was started or the interface statistics were cleared. Possible causes of dropped packets are CRC, length (undersize or oversize), and alignment errors. rxdrops Number of inbound packets dropped by the channel's slave interfaces. Commonly dropped packets are multicast frames, spanning tree BPDUs, packets destined to a MAC not owned by the NetScaler when L2 mode is disabled, or packets tagged for a VLAN that is not bound to the interface. In most healthy networks, this statistic increments at a steady rate regardless of traffic load. A sharp spike in dropped packets generally indicates an issue with connected L2 switches, such as a forwarding database overflow resulting in packets being broadcast on all ports. txpackets Number of packets transmitted by slave interfaces of a channel since the NetScaler appliance was started or the interface statistics were cleared. txbytes Number of bytes transmitted by slave interfaces of a channel since the NetScaler appliance was started or the interface statistics were cleared. txerrors Number of outbound packets dropped by the hardware of a channel's slave interfaces since the NetScaler appliance was started or the interface statistics were cleared. Possible causes of dropped packets are length (undersize or oversize) errors and lack of resources. txdrops Number of packets dropped in transmission by a channel's slave interfaces for one of the following reasons: (1) VLAN mismatch. (2) Oversized packets. (3) Interface congestion. (4) Loopback packets sent on non-loopback interface. inDisc Number of error-free inbound packets discarded by a channel's slave interfaces because of a lack of resources (for example, insufficient receive buffers). outDisc Number of error-free outbound packets discarded by a channel's slave interfaces because of a lack of resources. This statistic is not available on: (1) 10G ports of NetScaler MPX 12500/12500/15500-10G platforms. (2) 10G data ports on NetScaler MPX 17500/19500/21500 platforms. fctls
Number of times flow control is performed on a channel's slave interfaces because of pause frames. hangs Number of hangs that occurred on the channel's slave interfaces. stsStalls Number of status stalls that occurred on the channel's slave interfaces. txStalls Number of Tx stalls happened that occurred on the channel's slave interfaces. rxStalls Number of Rx stalls that occurred on the channel's slave interfaces. bdgMuted Number of times a channel's slave interfaces stopped transmitting and receiving packets because of MAC moves between ports. vmac Virtual MAC of this channel. vmac6 Virtual MAC for IPv6 on this interface. ifAlias The alias name for the interface. reqThroughput Minimum required throughput for an interface. Failover is triggered if the operating throughput of a Link Aggregation (LA) channel for which HAMON is ON falls below this value. throughput Minimum required throughput for the interface. throughput Actual throughput for the interface. bandwidthHigh High threshold, in Mbps, for bandwidth usage by the interface. A trap is sent if bandwidth usage by the interface crosses this limit. bandwidthNormal Normal threshold, in Mbps, for bandwidth usage by the interface. A trap is sent if bandwidth usage by the interface returns to this value. ifnum The interfaces bound to link aggregate channel. backplane The cluster backplane status of the LA. If the status is enabled, the LA is part of the cluster backplane. By default, the backplane status is disabled. clearTime Time since the interface stats are cleared last time. slavestate State of the member interfaces. slavemedia Media type of the member interfaces. slavespeed
Speed of the member interfaces. slaveduplex Duplex of the member interfaces. slaveflowctl Flowcontrol of the member interfaces. slavetime UP time of the member interfaces. count Example Related Commands add channel rm channel set channel unset channel bind channel unbind channel
add fis
Synopsis add fis <name> Description Add an FIS. Each FIS is identified by a name (string max 31 letters). The FIS created is empty (without members). Arguments name A name for the FIS to be created. Must begin with a letter, a number, or the underscore symbol, and can consist of from 1 to 31 letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the FIS. Example Related Commands rm fis bind fis unbind fis show fis
rm fis
Synopsis rm fis <name>
Description Remove the FIS created by the add fis command. Once the FIS is removed, its interfaces become CIs. Arguments name The name of the FIS that you want to remove from the NetScaler appliance. Example
Related Commands add fis bind fis unbind fis show fis
bind fis
Synopsis bind fis <name> <ifnum> ... Description Bind interfaces to an FIS. Adding an interface to an FIS deletes it from CIs and adds it to the new FIS. Arguments name The name of the FIS to which you want to bind interfaces. ifnum The interface to be bound to the FIS, specified in the slot/port notation (for example, 1/3). Example
Related Commands add fis rm fis unbind fis show fis
unbind fis
Synopsis unbind fis <name> <ifnum> ... Description Unbind the specified interface from the FIS. The interface unbound becomes a CI.
Arguments name The name of the FIS from which you want to unbind the interfaces. ifnum Interfaces that you want to unbind from the FIS. The format for specifying an interface is slot/port notation (for example, 1/3). Example
Related Commands add fis rm fis bind fis show fis
show fis
Synopsis show fis [<name>] Description Displays the configured FISs. Arguments name The name of the FIS configured on the appliance. summary fullValues format level ifaces Interfaces to be bound to the FIS, in slot/port notation (for example, 1/3). count stateflag Example >show fis 1) FIS: fis1 Member Interfaces : 1/1 Done
Related Commands add fis rm fis bind fis
unbind fis
add route
Synopsis add route <network> <netmask> <gateway> [-distance <positive_integer>] [-cost <positive_integer>] [-weight <positive_integer>] [-advertise ( DISABLED | ENABLED )] [-protocol <protocol> ...] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] Description Add a static route to the routing table. Arguments network An IPv4 network address for which you want to add a route entry in the routing table of the NetScaler appliance. netmask The subnet mask associated with the network address. gateway The IP address of the gateway for this route. Can be null to specify a null-interface route. cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Possible values: 0 through 65535. Default: 0. Maximum value: 65535 distance Administrative distance of this route from the appliance. Default value: STATIC_ROUTE_DEFAULT_DISTANCE Minimum value: 1 Maximum value: 255 cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Possible values: 0 through 65535. Default: 0. Maximum value: 65535 weight Value to facilitate balancing the load on ECMP routes. This value is compared with the hashed value of the packet, and a route is then chosen. Specific to ECMP routes. Default value: ROUTE_DEFAULT_WEIGHT Minimum value: 1 Maximum value: 65535 advertise State of advertisement of this route by dynamic routing protocols. Possible values: DISABLED, ENABLED protocol Routing protocols used for advertising routes if route advertisement is enabled. Note: For this setting to work, you must configure the dynamic routing protocol from the VTYSH command line. For more information about configuring dynamic routing protocols on the NetScaler appliance, see the "Dynamic Routing" chapter of the Citrix NetScaler Networking Guide. msr Monitor this route to verify its reachability through the gateway. Possible values: ENABLED, DISABLED Default value: DISABLED Example add route 10.10.10.0 255.255.255.0 10.10.10.1
Related Commands show arp rm arp clear route rm route set route unset route show route
clear route
Synopsis clear route <routeType> Description Remove routes of a particular type from the routing table of the NetScaler appliance. Arguments routeType The type of the route. Example
Related Commands add route rm route set route unset route show route
rm route
Synopsis rm route <network> <netmask> <gateway> Description Remove a configured static route from the system. You cannot remove direct routes by using this command. Use the rm ip command to remove the direct routes. Arguments network The network address specified in the route entry that you want to remove from the routing table of the NetScaler appliance.
netmask The subnet mask associated with the network address. gateway IP address of the gateway for the route that you want to remove. Example
Related Commands add route clear route set route unset route show route
set route
Synopsis set route <network> <netmask> <gateway> [-distance <positive_integer>] [-cost <positive_integer>] [-weight <positive_integer>] [-advertise ( DISABLED | ENABLED ) | -protocol <protocol> ...] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] Description Set the attributes of a route that was added by the add route command. Arguments network The network address specified in the route entry that you want to modify. netmask The subnet mask associated with the network address. gateway The gateway for the destination network of the route. distance Administrative distance of this route from the appliance. Default value: STATIC_ROUTE_DEFAULT_DISTANCE Minimum value: 1 Maximum value: 255 cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Possible values: 0 through 65535. Default: 0. Maximum value: 65535 weight Value to facilitate balancing the load on ECMP routes. This value is compared with the hashed value of the packet, and a route is then chosen. Specific to ECMP routes. Default value: ROUTE_DEFAULT_WEIGHT Minimum value: 1 Maximum value: 65535 advertise State of advertisement of this route by dynamic routing protocols. Possible values: DISABLED, ENABLED protocol
Routing protocols used for advertising routes if route advertisement is enabled. Note: For this setting to work, you must configure the dynamic routing protocol from the VTYSH command line. For more information about configuring dynamic routing protocols on the NetScaler appliance, see the "Dynamic Routing" chapter of the Citrix NetScaler Networking Guide. msr Monitor this route to verify its reachability through the gateway. Possible values: ENABLED, DISABLED Default value: DISABLED Example set route 10.10.10.0 255.255.255.0 10.10.10.1 -advertise enable
Related Commands add route clear route rm route unset route show route
unset route
Synopsis unset route <network> <netmask> <gateway> [-advertise ( DISABLED | ENABLED ) | -protocol <protocol> ...] [distance] [-cost] [-weight] [-msr] [-monitor] Description Unset the attributes of a route that were added by the add/set route command..Refer to the set route command for meanings of the arguments. Arguments Example unset route 10.10.10.0 255.255.255.0 10.10.10.1 -advertise enable
Related Commands add route clear route rm route set route show route
show route
Synopsis show route [<network> <netmask> [<gateway>]] [<routeType>] [-detail]
Description Display the configured routing information. Arguments network The destination network or host. routeType The type of routes to be shown. detail Display a detailed view. summary fullValues format level gatewayName The name of the gateway for this route. For a route other than a link load balancing (LLB) route, this value is null. advertise Enable advertisement. type State of the RNAT. stateflag dynamic State of the route. STATIC PERMANENT DIRECT NAT LBROUTE ADV TUNNEL Show whether it is a tunnel route or not. cost Cost of this route. distance Administrative distance of this route from the appliance. cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Possible values: 0 through 65535. Default: 0. weight The weight of this route.
data Internal data of this route. data0 Internal route type is stored, used for get. flags If this route is dynamic, the name of the routing protocol from which it was learned. routeOwners Use this option with -dynamic and in a cluster only to specify the set of nodes from which this dynamic route has been learnt. retain OSPF OSPF protocol. ISIS ISIS protocol. RIP RIP protocol. BGP BGP protocol. DHCP advOSPF Advertised through OSPF protocol. advISIS Advertised through ISIS protocol. advRIP Advertised through RIP protocol. advBGP Advertised through BGP protocol. msr Whether MSR is enabled or disabled. monitor A PING or ARP monitor to monitor the static route. state The state of the static route. Possible values: UP, DOWN. totalprobes The total number of probes sent. totalfailedprobes The total number of failed probes. failedprobes Number of the current failed monitoring probes. monStatCode The code indicating the monitor response. monStatParam1
First parameter used with the message code. monStatParam2 Second parameter used with the message code. monStatParam3 Third parameter used with the message code. count Example An example of the output of the show route command is as follows: 3 configured routes: Network Netmask Gateway/OwnedIP Type ------- ------- --------------- ---- 1) 0.0.0.0 0.0.0.0 10.11.0.254 STATIC 2) 127.0.0.0 255.0.0.0 127.0.0.1 PERMANENT 3) 10.251.0.0 255.255.0.0 10.251.0.254 NAT Related Commands add route clear route rm route set route unset route
add vlan
Synopsis add vlan <id> [-aliasName <string>] [-ipv6DynamicRouting ( ENABLED | DISABLED )] Description Create a VLAN. Each VLAN is identified by a VID (integer from 1 through 4094). The VLAN created is empty (without members) and is not active until interfaces are bound to it. Initially, all interfaces are bound to VLAN 1, which is created automatically and cannot be deleted. Arguments id An integer that uniquely identifies the VLAN that you want to remove from the NetScaler appliance. Once the VLAN is removed, its interfaces become members of VLAN 1. Minimum value: 1 Maximum value: 4094 aliasName A name for the VLAN. Must begin with a letter, a number, or the underscore symbol, and can consist of from 1 to 31 letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the VLAN. However, you cannot perform any VLAN operation by specifying this name instead of the VLAN ID. ipv6DynamicRouting Enable all IPv6 dynamic routing protocols on this VLAN. Possible values: ENABLED, DISABLED Default: DISABLED. Note: For the ENABLED setting to work, you must configure IPv6 dynamic routing protocols from the VTYSH command line. For more information about configuring IPv6 dynamic routing protocols on the NetScaler appliance, see the "Dynamic Routing" chapter of the Citrix NetScaler Networking Guide. Possible values: ENABLED, DISABLED Default value: DISABLED
Example Related Commands rm vlan set vlan unset vlan bind vlan unbind vlan show vlan stat vlan
rm vlan
Synopsis rm vlan <id> Description Remove the VLAN created by the add vlan command. Once the VLAN is removed, its interfaces become members of VLAN 1. Arguments id The VLAN Id. Minimum value: 2 Maximum value: 4094 Example Related Commands add vlan set vlan unset vlan bind vlan unbind vlan show vlan stat vlan
set vlan
Synopsis set vlan <id> [-aliasName <string>] [-ipv6DynamicRouting ( ENABLED | DISABLED )] Description Set VLAN parameters. Arguments id An integer that uniquely identifies the VLAN that you want to remove from the NetScaler appliance. Once the VLAN is removed, its interfaces become members of VLAN 1. Minimum value: 1 Maximum value: 4094
aliasName A name for the VLAN. Must begin with a letter, a number, or the underscore symbol, and can consist of from 1 to 31 letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the VLAN. However, you cannot perform any VLAN operation by specifying this name instead of the VLAN ID. ipv6DynamicRouting Enable all IPv6 dynamic routing protocols on this VLAN. Possible values: ENABLED, DISABLED Default: DISABLED. Note: For the ENABLED setting to work, you must configure IPv6 dynamic routing protocols from the VTYSH command line. For more information about configuring IPv6 dynamic routing protocols on the NetScaler appliance, see the "Dynamic Routing" chapter of the Citrix NetScaler Networking Guide. Possible values: ENABLED, DISABLED Default value: DISABLED Example set vlan 2 -dynamicRouting ENABLED Related Commands add vlan rm vlan unset vlan bind vlan unbind vlan show vlan stat vlan
unset vlan
Synopsis unset vlan <id> [-aliasName] [-ipv6DynamicRouting] Description Use this command to remove vlan settings.Refer to the set vlan command for meanings of the arguments. Arguments Example
Related Commands add vlan rm vlan set vlan bind vlan unbind vlan show vlan stat vlan
bind vlan
Synopsis bind vlan <id> [-ifnum <interface_name> ... [-tagged]] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Bind an interface or an IP address to a VLAN. An interface can be bound to a VLAN as a tagged or an untagged interface. Adding an interface as an untagged member (the default) deletes it from its current native VLAN and adds it to the new VLAN. If an interface is added as a tagged member to a VLAN, it still remains a member of its native VLAN. Arguments id Specifies the virtual LAN ID. Minimum value: 1 Maximum value: 4094 ifnum The interface to be bound to the VLAN, specified in slot/port notation (for example, 1/3). Minimum value: 1 IPAddress The network address to be associated with the VLAN. This address should exist on the appliance before you associate it with the VLAN. Example Related Commands add vlan rm vlan set vlan unset vlan unbind vlan show vlan stat vlan
unbind vlan
Synopsis unbind vlan <id> [-ifnum <interface_name> ... [-tagged]] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Unbind the specified interface from the VLAN. If the interface was an untagged member of this VLAN, it is added to the default VLAN (VLAN 1). Arguments id The virtual LAN (VLAN) id. Minimum value: 1 Maximum value: 4094 ifnum The interface that you want to unbind from the VLAN, specified in slot/port notation (for example, 1/3). Minimum value: 1 IPAddress The IP Address associated with the VLAN configuration.
Example
Related Commands add vlan rm vlan set vlan unset vlan bind vlan show vlan stat vlan
show vlan
Synopsis show vlan [<id>] show vlan stats - alias for 'stat vlan' Description Display the configured VLANs. If an ID is specified, only that particular VLAN information is displayed. Otherwise, all configured VLANs are displayed. Arguments id An integer that uniquely identifies the VLAN for which the details are to be displayed. Minimum value: 1 Maximum value: 4094 summary fullValues format level aliasName A name for the VLAN. Must begin with a letter, a number, or the underscore symbol, and can consist of from 1 to 31 letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the VLAN. However, you cannot perform any VLAN operation by specifying this name instead of the VLAN ID. IPAddress The IP address assigned to the VLAN. netmask The subnet mask for the network address defined for this VLAN. rnat Temporary flag used for internal purpose. stateflag state flag portbitmap Member interfaces of this vlan.
lsbitmap Member linksets of this vlan. tagbitmap Tagged members of this vlan. lstagbitmap Tagged linksets of this vlan. ifaces Names of all member interfaces of this vlan. tagIfaces Names of all tagged member interfaces of this vlan. ipv6DynamicRouting Whether dynamic routing is enabled or disabled. flag ifnum The interface to be bound to the VLAN, specified in slot/port notation (for example, 1/3). tagged Make the interface an 802.1q tagged interface. Packets sent on this interface on this VLAN have an additional 4-byte 802.1q tag, which identifies the VLAN. To use 802.1q tagging, you must also configure the switch connected to the appliance's interfaces. count Example An example of the output of the show vlan command is as follows: 1) VLAN ID: 5 VLAN Alias Name: Interfaces : 1/7 IPs : 10.102.169.36 Mask: 255.255.255.0 2) VLAN ID: 3 VLAN Alias Name: Interfaces : 1/5(T) Channels : LA/2 Done *(T) - Tagged Related Commands add vlan rm vlan set vlan unset vlan bind vlan unbind vlan stat vlan
stat vlan
Synopsis stat vlan [<id>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics for VLAN(s). Arguments id
An integer specifying the VLAN identification number (VID). Possible values: 1 through 4094. Minimum value: 1 Maximum value: 4094 count devno stateflag Packets received (RxPkts) Packets received on the VLAN. Bytes received (RxBytes) Bytes of data received on the VLAN. Packets sent (TxPkts) Packets transmitted on the VLAN. Bytes sent (TxBytes) Bytes of data transmitted on the VLAN. Packets dropped (DropPkts) Inbound packets dropped by the VLAN upon reception. Broadcast pkts sent & received (BcastPkt) Broadcast packets sent and received on the VLAN. Example stat vlan 1 Related Commands add vlan rm vlan set vlan unset vlan bind vlan unbind vlan show vlan stat interface stat rnat stat bridge stat rnatip
add vrID
Synopsis add vrID <id> [-priority <positive_integer>] [-preemption ( ENABLED | DISABLED )] [-sharing ( ENABLED | DISABLED )] [-tracking <tracking>] Description This command creates a virtual MAC address (VMAC). Each VMAC is identified by a VRID (integer from 1 through 255). The VMAC created is empty (without members) and is inactive until interfaces are bound to it.
Arguments id An integer value that uniquely identifies the VMAC address. The generic VMAC address is in the form of 00:00:5e:00:01:<VRID>. For example, if you add a VRID with a value of 60 and bind it to an interface, the resulting VMAC address is 00:00:5e:00:01:3c, where 3c is the hexadecimal representation of 60. Minimum value: 1. Maximum value: 255. Minimum value: 1 Maximum value: 255 priority Base priority (BP) that determines the master VIP address. Set this parameter only if you are configuring the appliance in the active-active mode. Default value: 255 Minimum value: 1 Maximum value: 255 preemption Make a backup VIP address the master if its priority becomes higher than that of a master VIP address bound to this VMAC address. Set this parameter only if you are configuring the appliance in the active-active mode. Possible values: ENABLED, DISABLED Default value: ENABLED sharing Enable the backup VIP address to process any traffic, instead of dropping the traffic. Set this parameter only if you are configuring the appliance in the active-active mode. Possible values: ENABLED, DISABLED Default value: DISABLED tracking The effective priority (EP) value, relative to the base priority (BP) value. Set this parameter only if you are configuring the appliance in the active-active mode. When EP is set to a value other than None, it is EP, not BP, which determines the master VIP address. For example, if a VIP address on NetScaler appliance NS1 has a priority of 101, and the same VIP address on NS2 has a priority of 99, the VIP address on NS1 is active. However, if two virtual servers are using the VIP address on NS1, and one of them is DOWN, health tracking can reduce the EP of VIP on NS1. VRRP then makes the VIP address on NS2 the active VIP address. Possible values for EP are: NONE. No tracking. EP=BP. (This is the default.) ALL. If the status of all virtual servers is UP, EP=BP. Otherwise, EP=0. ONE. If the status of at least one virtual server is UP, EP=BP. Otherwise, EP=0. PROGRESSIVE. If the status of all virtual servers is UP, EP=BP. If the status of all virtual servers is DOWN, EP=0. Otherwise EP=BP (1 - K/N), where N is the total number of virtual servers associated with the VIP address and K is the number of virtual servers whose status is DOWN. Possible values: NONE, ONE, ALL, PROGRESSIVE Default value: TRACK_NONE Example add vrID 1 Related Commands rm vrID set vrID unset vrID bind vrID unbind vrID show vrID
rm vrID
Synopsis rm vrID (<id> | -all)
Description Remove the VRID created by the add command. Arguments id An integer value that uniquely identifies the VMAC address that you want to remove. Minimum value: 1 Maximum value: 255 all Remove all the configured VMAC addresses from the NetScaler appliance. Example
Related Commands add vrID set vrID unset vrID bind vrID unbind vrID show vrID
set vrID
Synopsis set vrID <id> [-priority <positive_integer>] [-preemption ( ENABLED | DISABLED )] [-sharing ( ENABLED | DISABLED )] [-tracking <tracking>] Description Set the attributes of a VRID that was added by the add vrID command. Arguments id An integer value that uniquely identifies the VMAC address. The generic VMAC address is in the form of 00:00:5e:00:01:<VRID>. For example, if you add a VRID with a value of 60 and bind it to an interface, the resulting VMAC address is 00:00:5e:00:01:3c, where 3c is the hexadecimal representation of 60. Minimum value: 1. Maximum value: 255. Minimum value: 1 Maximum value: 255 priority Base priority (BP) that determines the master VIP address. Set this parameter only if you are configuring the appliance in the active-active mode. Default value: 255 Minimum value: 1 Maximum value: 255 preemption Make a backup VIP address the master if its priority becomes higher than that of a master VIP address bound to this VMAC address. Set this parameter only if you are configuring the appliance in the active-active mode. Possible values: ENABLED, DISABLED Default value: ENABLED sharing Enable the backup VIP address to process any traffic, instead of dropping the traffic. Set this parameter only if you are configuring the appliance in the active-active mode. Possible values: ENABLED, DISABLED Default value: DISABLED tracking
The effective priority (EP) value, relative to the base priority (BP) value. Set this parameter only if you are configuring the appliance in the active-active mode. When EP is set to a value other than None, it is EP, not BP, which determines the master VIP address. For example, if a VIP address on NetScaler appliance NS1 has a priority of 101, and the same VIP address on NS2 has a priority of 99, the VIP address on NS1 is active. However, if two virtual servers are using the VIP address on NS1, and one of them is DOWN, health tracking can reduce the EP of VIP on NS1. VRRP then makes the VIP address on NS2 the active VIP address. Possible values for EP are: NONE. No tracking. EP=BP. (This is the default.) ALL. If the status of all virtual servers is UP, EP=BP. Otherwise, EP=0. ONE. If the status of at least one virtual server is UP, EP=BP. Otherwise, EP=0. PROGRESSIVE. If the status of all virtual servers is UP, EP=BP. If the status of all virtual servers is DOWN, EP=0. Otherwise EP=BP (1 - K/N), where N is the total number of virtual servers associated with the VIP address and K is the number of virtual servers whose status is DOWN. Possible values: NONE, ONE, ALL, PROGRESSIVE Default value: TRACK_NONE Example set vrID 1 -priority 100 Related Commands add vrID rm vrID unset vrID bind vrID unbind vrID show vrID
unset vrID
Synopsis unset vrID <id> [-priority] [-preemption] [-sharing] [-tracking] Description Use this command to remove vrID settings.Refer to the set vrID command for meanings of the arguments. Arguments Example Related Commands add vrID rm vrID set vrID bind vrID unbind vrID show vrID
bind vrID
Synopsis bind vrID <id> -ifnum <interface_name> ...
Description Bind an interface to a vrID. Arguments id An integer value that uniquely identifies the VMAC address. The generic VMAC address is in the form of 00:00:5e:00:01:<VRID>. For example, if you add a VRID with a value of 60 and bind it to an interface, the resulting VMAC address is 00:00:5e:00:01:3c, where 3c is the hexadecimal representation of 60. Minimum value: 1. Maximum value: 255. Minimum value: 1 Maximum value: 255 ifnum Interfaces that you want to bind to the VMAC. The format for specifying an interface is slot/port notation (for example, 1/2). Example add vrID 1 Related Commands add vrID rm vrID set vrID unset vrID unbind vrID show vrID
unbind vrID
Synopsis unbind vrID <id> -ifnum <interface_name> ... Description Unbind specified interfaces from the VRID. Arguments id An integer value that uniquely identifies the VMAC address. The generic VMAC address is in the form of 00:00:5e:00:01:<VRID>. For example, if you add a VRID with a value of 60 and bind it to an interface, the resulting VMAC address is 00:00:5e:00:01:3c, where 3c is the hexadecimal representation of 60. Minimum value: 1. Maximum value: 255. Minimum value: 1 Maximum value: 255 ifnum Interfaces that you want to unbind from the VMAC. The format for specifying an interface is slot/ port notation (for example, 1/2). Example
Related Commands add vrID rm vrID
set vrID unset vrID bind vrID show vrID
show vrID
Synopsis show vrID [<id>] Description Display VRID table. Arguments id An integer value that uniquely identifies the VMAC address. Minimum value: 1 Maximum value: 255 summary fullValues format level ifaces Interfaces bound to this VRID. type Indicates whether this VRID entry was added manually or dynamically. When you manually add a VRID entry, the value for this parameter is STATIC. Otherwise, it is DYNAMIC. vlan The VLAN in which this VRID resides. priority Base priority (BP) that determines the master VIP address. Set this parameter only if you are configuring the appliance in the active-active mode. effectivePriority The effective priority of this VRID. preemption Make a backup VIP address the master if its priority becomes higher than that of a master VIP address bound to this VMAC address. Set this parameter only if you are configuring the appliance in the active-active mode. sharing Enable the backup VIP address to process any traffic, instead of dropping the traffic. Set this parameter only if you are configuring the appliance in the active-active mode. tracking The effective priority (EP) value, relative to the base priority (BP) value. Set this parameter only if you are configuring the appliance in the active-active mode. When EP is set to a value other than None, it is EP, not BP, which determines the master VIP address. For example, if a VIP address on NetScaler appliance NS1 has a priority of 101, and the same VIP address on NS2 has a priority of 99, the VIP address on NS1 is active. However, if two virtual servers are using the VIP address
on NS1, and one of them is DOWN, health tracking can reduce the EP of VIP on NS1. VRRP then makes the VIP address on NS2 the active VIP address. Possible values for EP are: NONE. No tracking. EP=BP. (This is the default.) ALL. If the status of all virtual servers is UP, EP=BP. Otherwise, EP=0. ONE. If the status of at least one virtual server is UP, EP=BP. Otherwise, EP=0. PROGRESSIVE. If the status of all virtual servers is UP, EP=BP. If the status of all virtual servers is DOWN, EP=0. Otherwise EP=BP (1 - K/N), where N is the total number of virtual servers associated with the VIP address and K is the number of virtual servers whose status is DOWN. flags Flags. IPAddress The IP address bound to the VRID. state State of this VRID. stateflag count Example show vrid Related Commands add vrID rm vrID set vrID unset vrID bind vrID unbind vrID
add vrID6
Synopsis add vrID6 <id> Description This command creates a virtual MAC address. Each VMAC is identified by a VRID (integer from 1 through 255).The VMAC created is empty (without members) and is inactive until interfaces are bound to it. Arguments id An integer value that uniquely identifies a VMAC6 address. Minimum value: 1 Maximum value: 255 Example add vrID6 1 Related Commands rm vrID6
bind vrID6 unbind vrID6 show vrID6
rm vrID6
Synopsis rm vrID6 (<id> | -all) Description Remove the VRID created by the add command. Arguments id An integer value that uniquely identifies a VMAC6 address that you want to remove. Minimum value: 1 Maximum value: 255 all Remove all configured VMAC6 addresses from the NetScaler appliance. Example
Related Commands add vrID6 bind vrID6 unbind vrID6 show vrID6
bind vrID6
Synopsis bind vrID6 <id> -ifnum <interface_name> ... Description Bind an interface to a VRID. Arguments id An integer value that uniquely identifies a VMAC6 address. Minimum value: 1 Maximum value: 255 ifnum Interfaces that you want to bind to the VMAC6. The format for specifying an interface is in slot/port notation, (for example, 1/2). Example add vrID6 1 Related Commands add vrID6
rm vrID6 unbind vrID6 show vrID6
unbind vrID6
Synopsis unbind vrID6 <id> -ifnum <interface_name> ... Description Unbind specified interfaces from the VRID. Arguments id An integer value that uniquely identifies a VMAC6 address. Minimum value: 1 Maximum value: 255 ifnum Interfaces that you want to unbind from the VMAC6. The format for specifying an interface is slot/ port notation (for example, 1/2). Example
Related Commands add vrID6 rm vrID6 bind vrID6 show vrID6
show vrID6
Synopsis show vrID6 [<id>] Description Display VRID6 table. Arguments id An integer value that uniquely identifies a VMAC6 address. Minimum value: 1 Maximum value: 255 summary fullValues format level ifaces Interfaces bound to this VRID.
ifnum Interfaces bound to this vrid. type Type (static or dynamic) of this VRID. vlan The VLAN in which this VRID resides. priority The priority of this VRID. state State of this VRID. flags Flags. stateflag IPAddress The IP address bound to the VRID6 count Example show vrid6 Related Commands add vrID6 rm vrID6 bind vrID6 unbind vrID6
add route6
Synopsis add route6 <network> [<gateway>] [-vlan <positive_integer>] [-weight <positive_integer>] [-distance <positive_integer>] [-cost <positive_integer>] [-advertise ( DISABLED | ENABLED )] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] Description Add an IPv6 static route to the forwarding table. VLAN number is needed only for link local addresses Arguments network An IPv6 network address for which you want to add a route entry in the routing table of the NetScaler appliance. gateway The gateway for this route. The value for this parameter is either an IPv6 address or null. vlan An integer that uniquely identifies the VLAN defined for this route. Maximum value: 4094 weight
Value for balancing the load on ECMP routes. This value is compared with the hashed value of the packet, and then a route is chosen. Specific to ECMP routes. Default value: 1 Minimum value: 1 Maximum value: 65535 distance Administrative distance of this route from the appliance. Default value: 1 Minimum value: 1 Maximum value: 254 cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Default value: 1 Maximum value: 65535 advertise The state of advertisement of this route. Possible values: DISABLED, ENABLED msr Enable MSR on this route. Possible values: ENABLED, DISABLED Default value: DISABLED Example add route6 ::/0 2004::1 add route6 ::/0 FE80::67 -vlan 5 Related Commands show route6 rm route6 clear route6 set route6 unset route6
clear route6
Synopsis clear route6 <routeType> Description Clear the IPv6 routes. Arguments routeType The type of the ipv6 route. Possible values: CONNECTED, DYNAMIC, OSPF, ISIS, RIP, BGP, STATIC, ND-RA-ROUTE. Example
Related Commands add route6 rm route6 set route6 unset route6 show route6
rm route6
Synopsis rm route6 <network> [<gateway>] [-vlan <positive_integer>] Description Remove a configured static route from the appliance. Arguments network The network of the route to be removed. gateway The gateway address of the route to be removed. vlan An integer that uniquely identifies the VLAN defined for this route. Maximum value: 4094 Example rm route6 ::/0 2004::1 rm route6 ::/0 FE80::67 -vlan 5 Related Commands add route6 clear route6 set route6 unset route6 show route6
set route6
Synopsis set route6 <network> [<gateway>] [-vlan <positive_integer>] [-weight <positive_integer>] [-distance <positive_integer>] [-cost <positive_integer>] [-advertise ( DISABLED | ENABLED )] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] Description Set the attributes of a route that was added by the add route command. Arguments network The IPv6 network address of the route entry that you want to modify. gateway The gateway for the route's destination network. vlan An integer that uniquely identifies the VLAN defined for this route. Maximum value: 4094 weight Value for balancing the load on ECMP routes. This value is compared with the hashed value of the packet, and then a route is chosen. Specific to ECMP routes. Default value: 1 Minimum value: 1 Maximum value: 65535 distance
Administrative distance of this route from the appliance. Default value: 1 Minimum value: 1 Maximum value: 254 cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. Default value: 1 Maximum value: 65535 advertise The state of advertisement of this route. Possible values: DISABLED, ENABLED msr Enable MSR on this route. Possible values: ENABLED, DISABLED Default value: DISABLED Example set route6 1::1/100 2000::1 -advertise enable Related Commands add route6 clear route6 rm route6 unset route6 show route6
unset route6
Synopsis unset route6 <network> [<gateway>] [-vlan <positive_integer>] [-weight] [-distance] [-cost] [-advertise] [-msr] [monitor] Description Unset the attributes of a route that were added by the add/set route command..Refer to the set route6 command for meanings of the arguments. Arguments Example unset route6 2000::1/100 3000::1 -advertise enable Related Commands add route6 clear route6 rm route6 set route6 show route6
show route6
Synopsis show route6 [<network> [<gateway>] [-vlan <positive_integer>]] [<routeType>] [-detail]
Description Display the configured routing information. Arguments network The IPv6 network address of the route entry for which the details are to be displayed. routeType The type of IPv6 routes to be to be displayed. Possible values: STATIC, CONNECTED, DYNAMIC, OSPF, ISIS, RIP, BGP, ND-RA-ROUTE, FIB6. detail To get a detailed view. summary fullValues format level gatewayName The name of the gateway for this route. advertise Any gateway of the route entry for which the details are to be displayed. type State of the RNAT. stateflag dynamic Whether this route is dynamically learned or not. weight Weight of this route. distance Administrative distance of this route from the appliance. cost The cost of a route is used to compare routes of the same type. The route having the lowest cost is the most preferred route. data Internal data of this route. flags For a dynamic route, the routing protocol from which the route was learned. msr Whether MSR is enabled or disabled. monitor The name of the monitor. state Whether this route is UP or DOWN. totalprobes The total number of probes sent.
totalfailedprobes The total number of failed probes. failedprobes Current number of failed monitoring probes. monStatCode The code indicating the monitor response. monStatParam1 First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. data1 Internal data of this route. retain STATIC Static route. PERMANENT Permanent Route. connected Connected Route. OSPFV3 For a dynamic route, the routing protocol from which the route was learned. ISIS If this route is dynamic then which routing protocol was it learnt from. active For a dynamic route, the routing protocol from which the route was learned. BGP For a dynamic route, the routing protocol from which the route was learned. RIP For a dynamic route, the routing protocol from which the route was learned. raRoute For a dynamic route, the routing protocol from which the route was learned. count Example Following is an example of the output of the show route6 command: Flags: Static(S), Dynamic(D), Active(A) --------------------------------------- Network Gateway(vlan) Flags ----------------- ----- 0::0/0 2001::1 S(A) 0::0/0 FE80::90(4) D(A) Related Commands add route6 clear route6
rm route6 set route6 unset route6
add nd6
Synopsis add nd6 <neighbor> <mac> <ifnum> [-vlan <integer>] Description Create a static entry for the ND6 table. Arguments neighbor IPv6 address of the adjacent network device that you want to add to the ND6 table. mac MAC address of the adjacent network device. ifnum The interface through which the adjacent network device is available, specified in slot/port notation, (for example, 1/3). vlan An integer value that uniquely identifies the VLAN on which the adjacent network device exists. Minimum value: 2. Maximum value: 4094. Example add nd6 2001::1 00:04:23:be:3c:06 5 1/1 Related Commands clear nd6 rm nd6 show nd6
clear nd6
Synopsis clear nd6 Description Remove all neighbor discovery entries from the NetScaler appliance. Arguments Example
Related Commands add nd6
rm nd6 show nd6
rm nd6
Synopsis rm nd6 <neighbor> [-vlan <integer>] Description Remove a static entry from the NetScaler nd6 table Arguments neighbor Link-local IPv6 address of the adjacent network device that you want to remove from the ND6 table. vlan An integer value that uniquely identifies the VLAN for the ND6 entry you want to remove. Example rm nd6 2001::1 5 1/1 Related Commands add nd6 clear nd6 show nd6
show nd6
Synopsis show nd6 [<neighbor>] Description Display the neighbor discovery information. Arguments neighbor IPv6 address of the adjacent network device that you want to add to the ND6 table. summary fullValues format level mac MAC address of the adjacent network device. state ND6 state
timeout Time elapsed ifnum The interface through which the adjacent network device is available, specified in slot/port notation, (for example, 1/3). vlan An integer value that uniquely identifies the VLAN on which the adjacent network device exists. Minimum value: 2. Maximum value: 4094. flags flag for static/permanent entry. channel The tunnel that is bound to a netbridge. count stateflag Example Following is an example of the output for the show nd6 command: Neighbor MACAddress(Vlan, Interface) State TIME(hh:mm:ss) -------- --------------------------- ----- -------------2001::1 00:04:23:be:3c:06(5, 1/1) REACHABLE 00:00:24 FE80::123:1 00:04:23:be:3c:07(4, 1/2) STALE 00:03:34
Related Commands add nd6 clear nd6 rm nd6
add inat
Synopsis add inat <name>@ <publicIP>@ <privateIP>@ [-tcpproxy ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-usip ( ON | OFF )] [-usnip ( ON | OFF )] [-proxyIP <ip_addr|ipv6_addr>] Description Create an inbound NAT with given public and private IP addresses. Arguments name A Name for the Inbound NAT (INAT) entry. The name must not exceed 127 characters, and the leading character must be a number or letter. The following characters are also allowed: @ _ - . (period) : (colon) # and space ( ). publicIP Public IP address of packets received on the NetScaler appliance. Can be either an IPv4 or an IPv6 address. Possible values: NetScaler-owned VIPs. privateIP IP address of the server to which the packet is sent by the NetScaler. Can be either an IPv4 or an IPv6 address.
tcpproxy Enable TCP proxying, which enables the NetScaler appliance to optimize the TCP traffic by using Layer 4 features. Possible values: ENABLED, DISABLED Default value: DISABLED ftp Enable the FTP protocol on the server for transferring files between the client and the server. Possible values: ENABLED, DISABLED Default value: DISABLED usip Enable the NetScaler appliance to retain the source IP address of the packets before sending the packets to the server. Possible values: ON, OFF Default value: ON usnip Enable the NetScaler appliance to use an SNIP address as the source IP address of the packets before sending the packets to the server. Possible values: ON, OFF Default value: ON proxyIP proxyIP A unique IP address used as the source IP address in packets sent to the server. Must be a MIP or SNIP address. Example add nat mynat 1.2.3.4 192.168.1.100
Related Commands rm inat set inat unset inat show inat
rm inat
Synopsis rm inat <name>@ Description Remove the specified Inbound NAT configuration. Arguments name Name of the Inbound NAT entry to be removed from the NetScaler appliance. Example rm nat mynat.
Related Commands add inat set inat unset inat show inat
set inat
Synopsis set inat <name>@ [-privateIP <ip_addr|ipv6_addr>@] [-tcpproxy ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-usip ( ON | OFF )] [-usnip ( ON | OFF )] [-proxyIP <ip_addr|ipv6_addr>] Description Modify some of the inbound NAT attributes. Arguments name The name of the Inbound NAT (INAT) entry that you want to modify. privateIP IP address of the server to which the packet is sent by the NetScaler. Can be either an IPv4 or an IPv6 address. tcpproxy Enable TCP proxying, which enables the NetScaler appliance to optimize the TCP traffic by using Layer 4 features. Possible values: ENABLED, DISABLED Default value: DISABLED ftp Enable the FTP protocol on the server for transferring files between the client and the server. Possible values: ENABLED, DISABLED Default value: DISABLED usip Enable the NetScaler appliance to retain the source IP address of the packets before sending the packets to the server. Possible values: ON, OFF Default value: ON usnip Enable the NetScaler appliance to use an SNIP address as the source IP address of the packets before sending the packets to the server. Possible values: ON, OFF Default value: ON proxyIP A unique IP address used as the source IP address in packets sent to the server. Must be a MIP or SNIP address. Example set nat mynat -tcpproxy ENABLED
Related Commands add inat rm inat unset inat show inat
unset inat
Synopsis unset inat <name>@ [-tcpproxy] [-ftp] [-usip] [-usnip] [-proxyIP]
Description Use this command to remove inat settings.Refer to the set inat command for meanings of the arguments. Arguments Example
Related Commands add inat rm inat set inat show inat
show inat
Synopsis show inat [<name>] Description show all configured inbound NAT. Arguments name A Name for the Inbound NAT (INAT) entry. The name must not exceed 127 characters, and the leading character must be a number or letter. The following characters are also allowed: @ _ - . (period) : (colon) # and space ( ). summary fullValues format level publicIP Public IP address of packets received on the NetScaler appliance. Can be either an IPv4 or an IPv6 address. Possible values: NetScaler-owned VIPs. privateIP IP address of the server to which the packet is sent by the NetScaler. Can be either an IPv4 or an IPv6 address. proxyIP Source IP address for connection to a server. tcpproxy Enable TCP proxying, which enables the NetScaler appliance to optimize the TCP traffic by using Layer 4 features. ftp Enable the FTP protocol on the server for transferring files between the client and the server. usip Enable the NetScaler appliance to retain the source IP address of the packets before sending the packets to the server.
usnip Enable the NetScaler appliance to use an SNIP address as the source IP address of the packets before sending the packets to the server. flags Flags for different modes count stateflag Example show nat
Related Commands add inat rm inat set inat unset inat
add bridgegroup
Synopsis add bridgegroup <id> [-ipv6DynamicRouting ( ENABLED | DISABLED )] Description Create a Bridge group. Arguments id An integer that uniquely identifies the bridge group. Minimum value: 1. Maximum value: 1000. Minimum value: 1 Maximum value: 1000 ipv6DynamicRouting Enable all IPv6 dynamic routing protocols on this VLAN. Possible values: ENABLED, DISABLED Default: DISABLED. Note: For the ENABLED setting to work, you must configure IPv6 dynamic routing protocols from the VTYSH command line. For more information about configuring IPv6 dynamic routing protocols on the NetScaler appliance, see the "Dynamic Routing" chapter of the Citrix NetScaler Networking Guide. Possible values: ENABLED, DISABLED Default value: DISABLED Example add bridgegroup bg1
Related Commands rm bridgegroup set bridgegroup unset bridgegroup bind bridgegroup
unbind bridgegroup show bridgegroup
rm bridgegroup
Synopsis rm bridgegroup <id> Description Remove the bridge group created by the add bridge group command. Arguments id An integer that uniquely identifies the bridge group that you want to remove from the NetScaler appliance. Minimum value: 1 Maximum value: 1000 Example
Related Commands add bridgegroup set bridgegroup unset bridgegroup bind bridgegroup unbind bridgegroup show bridgegroup
set bridgegroup
Synopsis set bridgegroup <id> -ipv6DynamicRouting ( ENABLED | DISABLED ) Description Set Bridge group parameters. Arguments id An integer value that uniquely identifies the bridge group. Minimum value: 1. Maximum value: 1000. Minimum value: 1 Maximum value: 1000 ipv6DynamicRouting Enable all IPv6 dynamic routing protocols on this bridge group. For this setting to work, you must configure IPv6 dynamic routing protocols from the VTYSH command line. For more information about configuring IPv6 dynamic routing protocols on the NetScaler appliance, see the Dynamic Routing chapter of the Citrix NetScaler Networking Guide. Possible values: ENABLED, DISABLED Default value: DISABLED Example set bridgegroup bg1 -dynamicRouting ENABLED
Related Commands add bridgegroup rm bridgegroup unset bridgegroup bind bridgegroup unbind bridgegroup show bridgegroup
unset bridgegroup
Synopsis unset bridgegroup <id> -ipv6DynamicRouting Description Use this command to remove bridgegroup settings.Refer to the set bridgegroup command for meanings of the arguments. Arguments Example
Related Commands add bridgegroup rm bridgegroup set bridgegroup bind bridgegroup unbind bridgegroup show bridgegroup
bind bridgegroup
Synopsis bind bridgegroup <id> [-vlan <positive_integer>] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Bind a vlan or an ip address to a bridgegroup. Arguments id The integer that uniquely identifies the bridge group. Minimum value: 1 Maximum value: 1000 vlan An integer that uniquely identifies the VLAN that you want to bind to this bridge group. Minimum value: 2 Maximum value: 4094 IPAddress A network address or addresses to be associated with the bridge group. You must add entries for these network addresses in the routing table before running this command.
Example bind bridgegroup bg1 -vlan 2
Related Commands add bridgegroup rm bridgegroup set bridgegroup unset bridgegroup unbind bridgegroup show bridgegroup
unbind bridgegroup
Synopsis unbind bridgegroup <id> [-vlan <positive_integer>] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Unbind the specified VLAN or IP address from bridge group. Arguments id The integer that uniquely identifies the bridge group. Minimum value: 1 Maximum value: 1000 vlan The ID of the VLAN that you want to unbind from this bridge group. Minimum value: 2. Maximum value: 4094. Minimum value: 2 Maximum value: 4094 IPAddress The network address associated with the bridge group. Example
Related Commands add bridgegroup rm bridgegroup set bridgegroup unset bridgegroup bind bridgegroup show bridgegroup
show bridgegroup
Synopsis show bridgegroup [<id>]
Description Display the configured bridge group. If a name is specified, only that particular bridge group information is displayed. Otherwise, all configured bridge groups are displayed. Arguments id The name of the bridge group. Minimum value: 1 Maximum value: 1000 summary fullValues format level IPAddress The IP address assigned to the bridge group. netmask The network mask for the subnet defined for the bridge group. flags Temporary flag used for internal purpose. portbitmap Member interfaces of this bridge group. tagbitmap Tagged members of this bridge group. ifaces Names of all member interfaces of this bridge group. tagIfaces Names of all tagged member interfaces of this bridge group. vlan Names of all member VLANs. ipv6DynamicRouting Whether dynamic routing is enabled or disabled. rnat Temporary flag used for internal purpose. flag count stateflag Example An example of the output of the show bridge group command is as follows: 2 configured Bridge Group: 1) Bridge Group: 1 Member vlans : 2 3 4 IP: 10.102.33.27 MASK: 255.255.255.0 2) Bridge Group: 2 Member vlans : 5 6 Related Commands add bridgegroup rm bridgegroup
set bridgegroup unset bridgegroup bind bridgegroup unbind bridgegroup
add ipTunnel
Synopsis add ipTunnel <name> <remote> <remoteSubnetMask> <local> [-protocol ( IPIP | GRE ) [-secure ( YES | NO )]] Description Add an ip tunnel. Arguments name Name of the IP Tunnel. The name must not exceed 127 characters, and the leading character must be a number or letter. The following characters are also allowed: @ _ - . (period) : (colon) # and space ( ). remote The remote IP address or subnet of the tunnel. remoteSubnetMask Subnet mask of the remote IP address of the tunnel. A public IPv4 address of the remote device used to set up the tunnel. For this parameter, you can also specify a network address if you specify IPIP (IP over IP) for the Protocol parameter. local A NetScaler owned public IPv4 address, configured on the local NetScaler appliance and used to set up the tunnel. Possible values: Auto, MIP, SNIP, VIP. Default: Auto. protocol The IP tunneling protocol. Possible values: IPIP, GRE Default value: TNL_IPIP secure Secure communication using IPSec. Possible values: YES, NO Default value: NO Example add iptunnel tunnel1 10.100.20.0 255.255.255.0 * Related Commands rm ipTunnel show ipTunnel
rm ipTunnel
Synopsis rm ipTunnel <name> Description Remove a configured IP tunnel from the system.
Arguments name The name of the IP Tunnel that you want to remove from the NetScaler appliance. Example rm iptunnel tunnel1
Related Commands set iptunnelParam show iptunnelParam add ipTunnel show ipTunnel
show ipTunnel
Synopsis show ipTunnel [(<remote> <remoteSubnetMask>) | <name>] Description Display the configured IP tunnels. Arguments remote The remote IP address or subnet of the tunnel. name Name of the IP Tunnel. The name must not exceed 127 characters, and the leading character must be a number or letter. The following characters are also allowed: @ _ - . (period) : (colon) # and space ( ). summary fullValues format level name The name of the ip tunnel. local A NetScaler owned public IPv4 address, configured on the local NetScaler appliance and used to set up the tunnel. Possible values: Auto, MIP, SNIP, VIP. Default: Auto. protocol The IP tunneling protocol. type The type of this tunnel. encapIp The effective local IP address of the tunnel. Used as the source of the encapsulated packets.
channel The tunnel that is bound to a netbridge. secure Secure communication using IPSec. tunnelType Indicates that a tunnel is User-Configured, Internal or DELETE-IN-PROGRESS. count stateflag Example 1) Name.........: t1 Remote.......: 10.102.33.0 Mask......: 255.255.255.0 Local........: * Encap.....: 0.0.0.0 Protocol.....: IPIP Type......: C 2) Name.........: tunnel1 Remote.......: 10.100.20.0 Mask......: 255.255.255.0 Local........: * Encap.....: 0.0.0.0 Protocol.....: IPIP Type......: C 3) Name.........: Remote.......: 10.102.33.190 Mask......: 255.255.255.255 Local........: * Encap.....: 10.102.33.85 Protocol.....: IPIP Type......: I
Related Commands set iptunnelParam show iptunnelParam add ipTunnel rm ipTunnel
add ip6Tunnel
Synopsis add ip6Tunnel <name> <remote> <local> Description Add an ip tunnel. Arguments name The name of the IPv6 tunnel. remote The remote IP address or subnet of the tunnel. local The local IP address of the tunnel. Example add ip6tunnel tun6 9901::200/64 *
Related Commands rm ip6Tunnel show ip6Tunnel
rm ip6Tunnel
Synopsis rm ip6Tunnel <name> Description Remove a configured IPv6 tunnel from the system. Arguments name The name of the IPv6 tunnel. Example rm ip6tunnel tun6 Related Commands set ip6tunnelParam show ip6tunnelParam add ip6Tunnel show ip6Tunnel
show ip6Tunnel
Synopsis show ip6Tunnel [<name> | <remote>] Description Display the configured IPv6 tunnels. Arguments name The name of the IPv6 tunnel. remote The remote IP address or subnet of the tunnel. summary fullValues format level remoteIP The remote IP address or subnet of the tunnel. local The local IP address of the tunnel. type The type of this tunnel. encapIp
The effective local IP address of the tunnel. Used as the source of the encapsulated packets. count stateflag Example 1) Name.........: tun61 Remote.......: 9901::200/64 Local........: * Encap.....: ::0/128 Type......: C 2) Name.........: tun62 Remote.......: 9903::400/84 Local........: 9903::100 Encap.....: ::0/128 Type......: C 3) Name.........: Remote.......: 9902::300/90 Local........: * Encap.....: 9902::100 Type......: I Related Commands set ip6tunnelParam show ip6tunnelParam add ip6Tunnel rm ip6Tunnel
add netbridge
Synopsis add netbridge <name> Description Add a network bridge. Arguments name The name of the network bridge. Example add netbridge bridge1 Related Commands rm netbridge show netbridge bind netbridge unbind netbridge
rm netbridge
Synopsis rm netbridge <name> Description Remove a network bridge. Arguments name The name of the network bridge.
Example remove netbridge bridge1 Related Commands add netbridge show netbridge bind netbridge unbind netbridge
show netbridge
Synopsis show netbridge [<name>] Description Show configured network bridges. Arguments name The name of the network bridge. format level tunnel The name of the tunnel that is a part of this bridge. vlan The VLAN that is extended by this network bridge. IPAddress The subnet that is extended by this network bridge. netmask The network mask for the subnet. flags Used internally for display. count stateflag Example
Related Commands add netbridge rm netbridge bind netbridge unbind netbridge
bind netbridge
Synopsis bind netbridge <name> [-tunnel <string> ...] [-vlan <positive_integer> ...] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Bind a network bridge to its attributes. Arguments name The name of the network bridge. tunnel The name of the tunnel that needs to be a part of this network bridge. vlan The VLAN that needs to be extended. Minimum value: 1 Maximum value: 4094 IPAddress The subnet that needs to be extended. Example bind netbridge bridge1 -tunnel tun0 Related Commands add netbridge rm netbridge show netbridge unbind netbridge
unbind netbridge
Synopsis unbind netbridge <name> [-tunnel <string> ...] [-vlan <positive_integer> ...] [-IPAddress <ip_addr|ipv6_addr|*> [<netmask>]] Description Unbind a network bridge from its attributes. Arguments name The name of the network bridge. tunnel The name of the tunnel that is part of this network bridge. vlan The vlan that is part of this network bridge. Minimum value: 1 Maximum value: 4094 IPAddress The subnet that is part of this network bridge.
Example unbind netbridge bridge1 -tunnel tun0 Related Commands add netbridge rm netbridge show netbridge bind netbridge
add ipset
Synopsis add ipset <name> Description Add an ipset. Arguments name The name of the IP set. Example add ipset pool1 Related Commands rm ipset bind ipset unbind ipset show ipset
rm ipset
Synopsis rm ipset <name> ... Description Remove an IP set. Arguments name The name of the IP set. Example rm ipset pool1 Related Commands add ipset
bind ipset unbind ipset show ipset
bind ipset
Synopsis bind ipset <name> <IPAddress>@ ... Description Bind an IP address to an IP set. Arguments name The name of the IP set. IPAddress One or more IP addresses to be bound to the IP set. Example bind ipset ipset_1 10.102.1.10 Related Commands add ipset rm ipset unbind ipset show ipset
unbind ipset
Synopsis unbind ipset <name> <IPAddress>@ ... Description Unbind an IP address to an IP set. Arguments name The name of the IP set. IPAddress One or more IP addresses to be unbound from the IP set. Example unbind ipset ipset_1 10.102.1.10 Related Commands add ipset rm ipset
bind ipset show ipset
show ipset
Synopsis show ipset [<name>] Description Show all IP sets, or the set of IP addresses bound to one IP set. Arguments name The name of the IP set. summary fullValues format level IPAddress One or more IP addresses bound to the IP set. stateflag state flag flags count Example show network ipset Related Commands add ipset rm ipset bind ipset unbind ipset
add linkset
Synopsis add linkset <id> Description Add the specified Linkset to the system. Arguments id Linkset Name (in form LS/*).
Example
Related Commands rm linkset bind linkset unbind linkset show linkset
rm linkset
Synopsis rm linkset <id> Description Remove the specified Linkset from the system. Arguments id Linkset Name (in form LS/*). Example
Related Commands add linkset bind linkset unbind linkset show linkset
bind linkset
Synopsis bind linkset <id> -ifnum <interface_name> ... Description This command binds specified interfaces to the Linkset. Arguments id Linkset Name (in form LS/*). ifnum the interfaces to be bound to Linkset. Example
Related Commands add linkset
rm linkset unbind linkset show linkset
unbind linkset
Synopsis unbind linkset <id> -ifnum <interface_name> ... Description This command unbinds specified interfaces from the Linkset. Arguments id Linkset Name (in form LS/*). ifnum the interfaces to be bound to Linkset. Example
Related Commands add linkset rm linkset bind linkset show linkset
show linkset
Synopsis show linkset [<id>] Description show the Linksets. Arguments id Linkset Name (in form LS/*). summary fullValues format level ifnum the interfaces to be bound to Linkset. stateflag state flag count
Example
Related Commands add linkset rm linkset bind linkset unbind linkset
add netProfile
Synopsis add netProfile <name> [-srcIP <string>] Description Add a network profile. Arguments name The name of the network profile. srcIP Source IP address or name of the IP set. Example add netProfile prof1 -srcip 10.102.1.10 Related Commands rm netProfile set netProfile unset netProfile show netProfile
rm netProfile
Synopsis rm netProfile <name> ... Description Remove a network profile. Arguments name The name of the network profile. Example rm netProfile prof1
Related Commands add netProfile set netProfile unset netProfile show netProfile
set netProfile
Synopsis set netProfile <name> [-srcIP <string>] Description Set the IP address or IP set for a network profile. Arguments name The name of the network profile. srcIP Source IP address or name of the IP set. Example set netProfile prof_1 -srcIP 10.102.1.10 Related Commands add netProfile rm netProfile unset netProfile show netProfile
unset netProfile
Synopsis unset netProfile <name> [-srcIP] Description Unset the IP address or IP set for a network profile..Refer to the set netProfile command for meanings of the arguments. Arguments Example unset netProfile prof1 -srcIP Related Commands add netProfile rm netProfile set netProfile
show netProfile
show netProfile
Synopsis show netProfile [<name>] Description Show all network profiles and the IP addresses or IP sets bound to each profile. Arguments name The name of the network profile. summary fullValues format level srcIP Source IPaddress or IPSET name. count stateflag Example show netProfile Related Commands add netProfile rm netProfile set netProfile unset netProfile
set arpparam
Synopsis set arpparam -timeout <positive_integer> Description Set arp global settings Arguments timeout The ARP table entry aging time, in seconds. Dynamic ARP entries are automatically removed after the specified amount of time Default value: 1200 Minimum value: 5 Maximum value: 1200 Example set arpparam -timeout 200
Related Commands unset arpparam show arpparam
unset arpparam
Synopsis unset arpparam -timeout Description Use this command to remove arpparam settings.Refer to the set arpparam command for meanings of the arguments. Arguments Example
Related Commands set arpparam show arpparam
show arpparam
Synopsis show arpparam Description Display ARP global settings. Arguments format level timeout The ARP table entry aging time, in seconds. Example show arpparam Related Commands set arpparam unset arpparam
show ci
Synopsis show ci
Description Display all the critical interfaces of the NetScaler appliance. This command is useful in a high availability configuration. Arguments summary fullValues ifaces Interfaces that are critical for the appliance to operate in high availability mode. count stateflag Example >show ci Critical Interfaces: LO/1 1/2
Related Commands
clear interface
Synopsis clear interface <id>@ Description Clear the statistics of the specified interface. The interface is not reset. Note: Resetting the interface does not clear the statistics. Arguments id The interface number, in the a/b format, of the interface that needs to be cleared. 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps ports and 10G ports of NetScaler 12000-10G and NetScaler MPX 15000 and 17000 platforms. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the groups defined by 'a'. Example
Related Commands set interface unset interface enable interface disable interface reset interface show interface stat interface
set interface
Synopsis set interface <id>@ [-speed <speed>] [-duplex <duplex>] [-flowControl <flowControl>] [-autoneg ( DISABLED | ENABLED )] [-haMonitor ( ON | OFF )] [-tagall ( ON | OFF )] [-lacpMode <lacpMode>] [-lacpKey <positive_integer>] [-lagtype ( NODE | CLUSTER )] [-lacpPriority <positive_integer>] [-lacpTimeout ( LONG | SHORT )] [-ifAlias <string>] [-throughput <positive_integer>] [-bandwidthHigh <positive_integer> [bandwidthNormal <positive_integer>]] Description Sets interface attributes such as media parameters (speed, duplex, and so on.), LACP, HA, and VLAN tags. Arguments id The interface number, in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'. speed The requested Ethernet speed of the interface. Possible values are: 1. AUTO: The default value. Specifies that the NetScaler appliance attempts to auto-negotiate or auto-sense the line speed of the interface when it is brought up. 2. 10, 100, 1000, and 10000: 10 Mbps, 100 Mbps, 1 Gbps, and 10 Gbps respectively. Setting a speed other than AUTO requires the device at the other end of the link to be configured identically. Mismatched speed and duplex settings lead to link errors, packet loss, and other errors. Some interfaces do not support certain speeds. If you specify an unsupported speed, an error message appears. Possible values: AUTO, 10, 100, 1000, 10000 Default value: NSA_DVC_SPEED_AUTO duplex The requested duplex mode for the interface. Possible values are: 1. AUTO: The default setting. Specifies that the NetScaler appliance attempts to auto-negotiate the duplex mode of the interface when it is brought up. 2. HALF 3. FULL For settings other than AUTO, duplex and speed settings should be identical at both ends of the link. Possible values: AUTO, HALF, FULL Default value: NSA_DVC_DUPLEX_AUTO flowControl The requested 802.3x flow control setting for the interface. Possible values are OFF (the default), RX, TX, RXTX, and ON ("forced RXTX"). The 802.3x specification does not define flow control for 10 Mbps and 100 Mbps speeds, but if a Gigabit Ethernet interface operates at those speeds, the flow control settings can be applied. The flow control setting that is finally applied to an interface depends on auto-negotiation. With the ON option, auto-negotiation gives the peer the opportunity to negotiate the flow control, but the appliance then forces two-way flow control for the interface. Any other link-parameter mismatches can sometimes cause problems and should be avoided by thoroughly checking the settings. Possible values: OFF, RX, TX, RXTX Default value: NSA_DVC_FC_OFF autoneg The state of auto-negotiation for the specified interface. Possible values are Enabled or Disabled. If auto-negotiation is enabled on an interface, that interface tries to auto-negotiate the speed and duplex settings with the link partner. If the user specifies a speed or duplex setting other then AUTO, auto-negotiation of that parameter does not occur. Possible values: DISABLED, ENABLED Default value: NSA_DVC_AUTONEG_ON
haMonitor Trigger a failover when the interface on which this option is enabled goes down. By default, this option is enabled on all interfaces. Citrix recommends that this option be disabled on all unused or noncritical interfaces. Possible values: ON, OFF Default value: NSA_DVC_MONITOR_ON tagall The appliance adds a four-byte 802.1q tag to every packet sent on this interface. ON applies tags for all the VLANs that are bound to this interface. OFF, applies the tag for all VLANs other than the native VLAN. Possible values: ON, OFF Default value: NSA_DVC_VTRUNK_OFF trunk This argument is deprecated by tagall. Possible values: ON, OFF Default value: NSA_DVC_VTRUNK_OFF lacpMode The LACP mode of the specified interface. The possible values are: 1. Active: A port in active mode generates LACP protocol messages on a regular basis, regardless of any need expressed by its partner to receive them. 2. Passive: A port in passive mode generally does not transmit LACP messages unless its partner is in the active mode; that is, it does not speak unless spoken to. 3. Disabled: Removes the interface from the LA channel. If this is only interface in the LA channel, the LA channel is also deleted. Possible values: DISABLED, ACTIVE, PASSIVE Default value: NSA_LACP_DISABLE lacpKey A digit that dentifies the LA channel to which the interface is bound. Possible values: 1, 2, 3, 4. Minimum value: 1 Maximum value: 8 lagtype LAG Type (Node/Cluster) Possible values: NODE, CLUSTER Default value: NSA_LAG_NODE lacpPriority LACP port priority, expressed as an integer ranging from 1 to 65535. The highest priority is 1. The NetScaler limits the number of interfaces in an LA channel to 8. If LACP is enabled on more than 8 interfaces, the NetScaler selects 8 interfaces, in decending order of port priority, to form an channel. Default value: 32768 Minimum value: 1 Maximum value: 65535 lacpTimeout Time to wait for the LACPDU. If a LACPDU is not received within this interval, the NetScaler markes the link partner port as DOWN. Possible values: Long and Short. Long lacptimeout is 90 sec and Short LACP timeout is 3 sec. Possible values: LONG, SHORT Default value: NSA_LACP_TIMEOUT_LONG ifAlias The alias name for the interface. Default value: " " throughput Minimum required throughput for an interface. Failover is triggered if the operating throughput of a Link Aggregation (LA) channel for which HAMON is ON falls below this value. bandwidthHigh Configured high threshold of the interface bandwidth usage in Mbits/s. Trap will be sent if bandwidth usage of the interface goes above this limit. Example Related Commands clear interface unset interface
enable interface disable interface reset interface show interface stat interface
unset interface
Synopsis unset interface <id>@ [-speed] [-duplex] [-flowControl] [-autoneg] [-haMonitor] [-tagall] [-lacpMode] [-lacpKey] [lacpPriority] [-lacpTimeout] [-ifAlias] [-throughput] [-bandwidthHigh] [-bandwidthNormal] Description Use this command to remove interface settings.Refer to the set interface command for meanings of the arguments. Arguments Example Related Commands clear interface set interface enable interface disable interface reset interface show interface stat interface
enable interface
Synopsis enable interface <id>@ Description Enable the interface. If the interface is physically UP, it can transmit and receive packets. By default, all interfaces are enabled. Note: To view the status of an interface, use the show interface command. Arguments id The interface number, in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'. Example Related Commands clear interface set interface
unset interface disable interface reset interface show interface stat interface
disable interface
Synopsis disable interface <id>@ Description Disables the interface from transmitting and receiving packets. However, the link remains active and partner devices remain unaware that the interface has been disabled. Interfaces marked for HA monitoring can be disabled, but doing so causes HA failover to occur. Note: To view the status of an interface, use the show interface command. Arguments id The interface number, in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'. Example Related Commands clear interface set interface unset interface enable interface reset interface show interface stat interface
reset interface
Synopsis reset interface <id>@ Description Restart the interface but leaves the administrative state (ENABLED or DISABLED) and configuration unchanged. The link pertaining to the interface is reestablished with the existing settings. Arguments id The interface number, in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'.
Example Related Commands clear interface set interface unset interface enable interface disable interface show interface stat interface
show interface
Synopsis show interface [<id>@] show interface stats - alias for 'stat interface' Description Show the interface settings configured on the appliance for the specified interface number. If id is not specified, the settings are shown for all interfaces (in a brief format). Arguments id The interface number in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'. summary fullValues format level stateflag deviceName Name of the interface. unit Unit number for this interface, signifying the sequence number in which this interface is discovered on this Netscaler. description Display the type of interface, the speeds at which this interface can operate, and, if applicable, the type of SFP,. flags Flags for this interface. Used for communicating the device states. mtu MTU for this interface (the largest frame that can transit this interface). vlan
Native VLAN for this interface. mac MAC address for this interface. uptime Duration for which the interface has been UP (Example: 3 hours 1 minute 1 second). This value is reset when the interface state changes to DOWN.. downTime Duration for which the interface has been DOWN. This value is reset when the interface state changes to UP.(Example: 3 hours 1 minute 1 second). reqMedia Requested media setting for this interface. reqSpeed Requested speed setting for this interface. reqDuplex Requested duplex setting for this interface. reqFlowcontrol Requested flow control setting for this interface. media speed The requested Ethernet speed of the interface. Possible values are: 1. AUTO: The default value. Specifies that the NetScaler appliance attempts to auto-negotiate or auto-sense the line speed of the interface when it is brought up. 2. 10, 100, 1000, and 10000: 10 Mbps, 100 Mbps, 1 Gbps, and 10 Gbps respectively. Setting a speed other than AUTO requires the device at the other end of the link to be configured identically. Mismatched speed and duplex settings lead to link errors, packet loss, and other errors. Some interfaces do not support certain speeds. If you specify an unsupported speed, an error message appears. duplex The requested duplex mode for the interface. Possible values are: 1. AUTO: The default setting. Specifies that the NetScaler appliance attempts to auto-negotiate the duplex mode of the interface when it is brought up. 2. HALF 3. FULL For settings other than AUTO, duplex and speed settings should be identical at both ends of the link. flowControl The requested 802.3x flow control setting for the interface. Possible values are OFF (the default), RX, TX, RXTX, and ON ("forced RXTX"). The 802.3x specification does not define flow control for 10 Mbps and 100 Mbps speeds, but if a Gigabit Ethernet interface operates at those speeds, the flow control settings can be applied. The flow control setting that is finally applied to an interface depends on auto-negotiation. With the ON option, auto-negotiation gives the peer the opportunity to negotiate the flow control, but the appliance then forces two-way flow control for the interface. Any other link-parameter mismatches can sometimes cause problems and should be avoided by thoroughly checking the settings. media Actual media setting for this interface. speed Actual speed setting for this interface. duplex Actual duplex setting for this interface.
flowControl Actual flow control setting for this interface. connDistr Connection distribution setting on this interface. macdistr MAC distribution setting on this interface. Mode Interface Link Aggregation mode (Auto/Manual) setting. haMonitor HA monitor enabled or disabled for this interface. state Link state of the interface (UP/DOWN). autoneg Interface autonegotiation enabled or disabled. autonegResult Actual auto-negotiation setting for this interface. tagged VLAN tags setting on this channel. tagall VLAN tagging behavior on this interface. With the ON setting,, packets are tagged with all the VLANs that are bound to this interface. With the OFF setting, packets are tagged with the native VLAN. trunk This argument is deprecated by tagall. taggedAny Interface setting to accept/drop all tagged packets. taggedAutolearn Dynamic VLAN membership autolearning enabled or disabled on this interface. hangDetect Hang detection enabled or disabled for this interface. hangReset Hang reset enabled or disabled for this interface. rxpackets Number of packets received by an interface since the NetScaler appliance was started or the interface statistics were cleared. rxbytes Number of bytes received by an interface since the NetScaler appliance was started or the interface statistics were cleared. rxerrors Number of inbound packets dropped by the hardware on a specified interface since the NetScaler appliance was started or the interface statistics were cleared. Packets can be dropped because of CRC, length (undersize or oversize), or alignment errors. rxdrops
Number of inbound packets dropped by the specified interface. Commonly dropped packets are multicast frames, spanning tree BPDUs, packets destined to a MAC not owned by the NetScaler appliance when L2 mode is disabled, or packets tagged for a VLAN that is not bound to the interface. In most healthy networks, this statistic increments at a steady rate regardless of traffic load. A sharp spike in dropped packets generally indicates an issue with connected L2 switches, such as a forwarding database overflow resulting in packets being broadcast on all ports. txpackets Number of packets transmitted by an interface since the NetScaler appliance was started or the interface statistics were cleared. txbytes Number of bytes transmitted by an interface since the NetScaler appliance was started or the interface statistics were cleared. txerrors Number of outbound packets dropped by the hardware on a specified interface since the NetScaler appliance was started or the interface statistics were cleared. Packets can be dropped because of length (undersize or oversize) errors or a lack of resources. This statistic is available only for: (1) Loop back interface (LO) of all platforms. (2) All data ports on the NetScaler 12000 platform. (3) Management ports on the Netscaler MPX 15000 and 17000 platforms. txdrops Number of packets dropped in transmission by the specified interface for one of the following reasons. (1) VLAN mismatch. (2) Oversized packets. (3) Interface congestion. (4) Loopback packets sent on non loop back interface. inDisc Number of error-free inbound packets discarded by the specified interface because of a lack of resources (for example, insufficient receive buffers). outDisc Number of error-free outbound packets discarded by the specified interface because of a lack of resources. This statistic is not available on: (1) 10G ports of NetScaler MPX 12500/12500/15500-10G platforms. (2) 10G data ports on NetScaler MPX 17500/19500/21500 platforms. fctls Number of times flow control is performed on the specified interface because of received pause frames. hangs Number of times the specified interface detected hangs in the transmit and receive paths since the NetScaler appliance was started or the interface statistics were cleared. stsStalls Number of times the status updates for a specified interface were stalled since the NetScaler appliance was started or the interface statistics were cleared. A status stall is detected when the status of the interface is not updated by the NIC hardware within 0.8 seconds of the last update. txStalls Number of times the interface stalled, when transmitting packets, since the NetScaler appliance was started or the interface statistics were cleared. Transmit (Tx) stalls are detected when a packet posted for transmission is not transmitted in 4 seconds. rxStalls Number of times the interface stalled, when receiving packets, since the NetScaler appliance was started or the interface statistics were cleared. Receive (Rx) stalls are detected when the following conditions are met: (1)The link is up for more than 10 minutes. (2)Packets are transmitted, but no packets are received for 16 seconds.
bdgMacMoved Number of MAC moves between ports. A high rate of MAC moves typically indicates a bridge loop between two interfaces. bdgMuted Number of times the specified interface stopped transmitting and receiving packets because of MAC moves between ports. vmac Virtual MAC of this interface. vmac6 Virtual MAC for IPv6 of this interface. lacpMode The LACP mode of the specified interface. The possible values are: 1. Active: A port in active mode generates LACP protocol messages on a regular basis, regardless of any need expressed by its partner to receive them. 2. Passive: A port in passive mode is generally not transmit LACP messages unless its partner is in the active mode; that is, it does not communicate to the other appliance unless other appliance communicates with this appliance. lacpKey Identifies the channel to which the interface is bound. The possible values are 1, 2, 3, and 4. lacpPriority LACP port priority, expressed as an integer ranging from 1 to 65535. The highest priority is 1. The NetScaler limits the number of interfaces in an LA channel to 8. If LACP is enabled on more than 8 interfaces, the NetScaler selects 8 interfaces, in decending order of port priority, to form an channel. lacpTimeout Time to wait for the LACPDU. If an LACPDU is not received within this interval, the NetScaler markes the link partner port as DOWN. Possible values; Long, Short. Long lacptimeout is 90 sec and Short LACP timeout is 3 sec. lagtype LAG Type (Node/Cluster) ifAlias The alias name for the interface. reqThroughput Minimum required throughput for an interface. Failover is triggered if the operating throughput of a Link Aggregation (LA) channel for which HAMON is ON falls below this value. throughput Minimum required throughput for the interface. throughput Actual throughput for the interface. bandwidthHigh Configured high threshold of the interface bandwidth usage in Mbits/s. Trap will be sent if bandwidth usage of the interface goes above this limit. bandwidthNormal Configured normal threshold of the interface bandwidth usage, in Mbps. A trap is sent if bandwidth usage of the interface returns to this limit. backplane The cluster backplane status of the interface. If the status is enabled, the interface is part of the cluster backplane. By default, the backplane status is disabled.
ifnum Contains the LA Master, if the interface is part of LA channel. clearTime Time since the interface stats are cleared last time. slavestate State of the member interfaces. slavemedia Media type of the member interfaces. slavespeed Speed of the member interfaces. slaveduplex Duplex of the member interfaces. slaveflowctl Flowcontrol of the member interfaces. slavetime UP time of the member interfaces. intftype Interface Type, this field will have the interface type either it is virtual, physical or loopback. count Example The output for the show interface command is as follows: 1) Interface 0/1 (Gig Ethernet 10/100/1000 MBits) #4 flags=0x4021 <ENABLED, UP, UP, autoneg, HAMON, 802.1q> MTU=1514, native vlan=1, MAC=00:30:48:67:9a:9a, uptime 1039h54m28s Requested: media AUTO, speed AUTO, duplex AUTO, fctl OFF, throughput 0 2) Interface 1/1 (Gig Ethernet, copper SFP) #3 flags=0x4021 <ENABLED, UP, UP, autoneg, HAMON, BACKPLANE, 802.1q> MTU=1514, native vlan=1, MAC=00:e0:ed:12:e8:b7, uptime 1039h54m28s Requested: media AUTO, speed AUTO, duplex AUTO, fctl OFF, throughput 0 3) Interface 1/2 (Gig Ethernet, copper SFP) #2 flags=0x4001 <ENABLED, DOWN, down, autoneg, HAMON, 802.1q> MTU=1514, native vlan=1, MAC=00:e0:ed:12:e8:b6, downtime 1039h54m28s Requested: media AUTO, speed AUTO, duplex AUTO, fctl OFF, throughput 0 4) Interface 1/3 (Gig Ethernet, copper SFP) #1 flags=0x4001 <disabled, DOWN, down, autoneg, HAMON, 802.1q> MTU=1514, native vlan=1, MAC=00:e0:ed:12:e8:b5, downtime 1039h54m33s Requested: media AUTO, speed AUTO, duplex AUTO, fctl OFF, throughput 0 5) Interface 1/4 (Gig Ethernet, copper SFP) #0 flags=0x4001 <disabled, UP, down, autoneg, HAMON, 802.1q> MTU=1514, native vlan=1, MAC=00:e0:ed:12:e8:b4, downtime 1039h54m28s Requested: media AUTO, speed AUTO, duplex AUTO, fctl OFF, throughput 0 Done > The output for the show interface 0/1 command is as follows: Interface 0/1 (Gig Ethernet 10/100/1000 MBits) #4 flags=0xc020 <ENABLED, UP, UP, autoneg, HAMON, 802.1q> MTU=1514, native vlan=1, MAC=00:30:48:67:9a:9a, uptime 0h00m40s Requested: media AUTO, speed AUTO, duplex AUTO, fctl RXTX, throughput 0 Actual: media UTP, speed 1000, duplex FULL, fctl RXTX, throughput 1000 RX: Pkts(27) Bytes(2034) Errs(0) Drops(27) Stalls(0) TX: Pkts(3) Bytes(170) Errs(0) Drops(22) Stalls(0) NIC: InDisc(0) OutDisc(0) Fctls(0) Stalls(0) Hangs(0) Muted(0) Bandwidth thresholds are not set. Done > Related Commands clear interface set interface
unset interface enable interface disable interface reset interface stat interface
stat interface
Synopsis stat interface [<id>@] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of interface(s). Arguments id The interface number, in a/b format, where 'a' can take one of the following values: 1. '0': Indicates a management interface. 2. '1': Indicates a 10/100/1000 Mbps port, or a 10G port on a NetScaler 12000-10G, NetScaler MPX 15000, or NetScaler 17000 platform. 3. '10': Indicates a 10 Gbps port. 4. 'LA': Indicates a link aggregation port. 5. 'LO': Indicates a loop back port. 'b' is an integer that is used to provide a unique label for the interfaces in the group defined by 'a'. count devno stateflag Interface State (IntfState) Current state of the specified interface. The interface state set to UP only if the link state is UP and administrative state is ENABLED . Link uptime (UpTime) Duration for which the link is UP. This statistic is reset when the state changes to DOWN. Link downtime (DnTime) Duration for which the link is DOWN. This statistic is reset when the state changes to UP. Bytes received (Rx Bytes) Number of bytes received by an interface since the NetScaler appliance was started or the interface statistics were cleared. Bytes transmitted (Tx Bytes) Number of bytes transmitted by an interface since the NetScaler appliance was started or the interface statistics were cleared. Packets received (Rx Pkts) Number of packets received by an interface since the NetScaler appliance was started or the interface statistics were cleared. Packets transmitted (Tx Pkts) Number of packets transmitted by an interface since the NetScaler appliance was started or the interface statistics were cleared. Multicast packets (McastPkt) Number of multicast packets received by the specified interface since the NetScaler appliance was started or the interface statistics were cleared. NetScaler packets (NSPkt)
Number of packets, destined to the NetScaler, received by an interface since the NetScaler appliance was started or the interface statistics were cleared. The packets destined to NetScaler are those that have the same MAC address as that of an interface or a VMAC address owned by the NetScaler. LACPDUs received (RxLacpdu) Number of Link Aggregation Control Protocol Data Units(LACPDUs) received by the specified interface since the NetScaler appliance was started or the interface statistics were cleared. LACPDUs transmitted (TxLacpdu) Number of Link Aggregation Control Protocol Data Units(LACPDUs) transmitted by the specified interface since the NetScaler appliance was started or the interface statistics were cleared. Error packets received (hw) (ErrRx) Number of inbound packets dropped by the hardware on a specified interface since the NetScaler appliance was started or the interface statistics were cleared. This could happen due to CRC, length (undersize and oversize), and alignment errors. Error packets transmitted (hw) (ErrTx) Number of outbound packets dropped by the hardware on a specified interface since the NetScaler appliance was started or the interface statistics were cleared. This could happen due to length (undersize or oversize) errors and lack of resources. This statistic is available only for: (1) Loop back interface (LO) of all platforms. (2) All data ports on the NetScaler 12000 platform. (3) Management ports on the MPX 15000 and 17000 platforms. Inbound packets discarded(hw) (InDisc) Number of error-free inbound packets discarded by the specified interface due to a lack of resources, for example, insufficient receive buffers. Outbound packets discarded(hw) (OutDisc) Number of error-free outbound packets discarded by the specified interface due to a lack of resources. This statistic is not available on: (1) 10G ports of NetScaler MPX 12500/12500/15500-10G platforms. (2) 10G data ports on NetScaler MPX 17500/19500/21500 platforms. Packets dropped in Rx (sw) (DrpRxPkt) Number of inbound packets dropped by the specified interface. Commonly dropped packets are multicast frames, spanning tree BPDUs, packets destined to a MAC not owned by the NetScaler when L2 mode is disabled, or packets tagged for a VLAN that is not bound to the interface. This statistic will increment in most healthy networks at a steady rate regardless of traffic load. If a sharp spike in dropped packets occurs, it generally indicates an issue with connected L2 switches, such as a forwarding database overflow resulting in packets being broadcast on all ports. Packets dropped in Tx (sw) (DrpTxPkt) Number of packets dropped in transmission by the specified interface due to one of the following reasons. (1) VLAN mismatch. (2) Oversized packets. (3) Interface congestion. (4) Loopback packets sent on non loop back interface. NIC hangs (Hangs) Number of times the specified interface detected hangs in the transmit and receive paths since the NetScaler appliance was started or the interface statistics were cleared. Status stalls (StsStall) Number of times the status updates for a specified interface were stalled since the NetScaler appliance was started or the interface statistics were cleared. A status stall is detected when the status of the interface is not updated by the NIC hardware within 0.8 seconds of the last update. Transmit stalls (TxStall)
Number of times the interface stalled, when transmitting packets, since the NetScaler appliance was started or the interface statistics were cleared. Transmit (Tx) stalls are detected when a packet posted for transmission is not transmitted in 4 seconds. Receive stalls (RxStall) Number of times the interface stalled, when receiving packets, since the NetScaler appliance was started or the interface statistics were cleared. Receive (Rx) stalls are detected when the following conditions are met: (1)The link is up for more than 10 minutes. (2)Packets are transmitted, but no packets is received for 16 seconds. Error-disables (ErrDis) Number of times the specified interface is disabled by the NetScaler, due to continuous Receive (Rx) or Transmit (Tx) stalls, since the NetScaler appliance was started or the interface statistics were cleared. The NetScaler disables an interface when one of the following conditions is met: (1) Three consecutive transmit stalls occur within 10 seconds. (2) Three consecutive receive stalls occur within 120 seconds. Duplex mismatches (DupMism) Number of times duplex mismatches were detected on the specified interface since the NetScaler appliance was started or the interface statistics were cleared. A mismatch will occur if the duplex mode is not identically set on both ends of the link. This statistic is only available on the NetScaler Classic edition. Link re-initializations (LnkReint) Number of times the link has been re-initialized. A re-initialization occurs due to link state change, configuration parameter change, or administrative reset operation. MAC moves registered (MacMvd) Number of MAC moves between ports. If a high rate of MAC moves is observed, it is likely that there is a bridge loop between two interfaces. Times NIC became muted (ErrMtd) Number of times the specified interface stopped transmitting and receiving packets due to MAC moves between ports. Interface Alias (IntfAlias) Alias Name for the Interface Link State (State) The current state of the link associated with the interface. For logical interfaces (LA), the state of the link is dependent on the state of the slave interfaces. For the link to be UP at least one of the slave interfaces needs to be UP. Example
Related Commands clear interface set interface unset interface enable interface disable interface reset interface show interface stat vlan
stat rnat stat bridge stat rnatip
clear rnat
Synopsis clear rnat ((<network> [<netmask>]) | (<aclname> [-redirectPort])) [-natIP <ip_addr|*>@ ...] Description Clear the Reverse NAT configuration. Arguments network The network address defined for the RNAT entry. netmask The subnet mask for the network address. aclname An extended ACL defined for the RNAT entry. redirectPort Port number to which the packets are redirected. Applicable to TCP and UDP protocols natIP The NAT IP address defined for the RNAT entry. Example
Related Commands set rnat unset rnat stat rnat show rnat
set rnat
Synopsis set rnat ((<network> [<netmask>] [-natIP <ip_addr|*>@ ...]) | (<aclname> [-redirectPort <port>] [-natIP <ip_addr| *>@ ...])) Description Configure Reverse NAT on the system. Arguments network The network address defined for the RNAT entry. aclname An extended ACL defined for the RNAT entry.
Example
Related Commands clear rnat unset rnat stat rnat show rnat
unset rnat
Synopsis unset rnat ((<network> [<netmask>]) | (<aclname> [-redirectPort])) [-natIP <ip_addr|*>@ ...] Description Use this command to modify the parameters of configured Reverse NAT on the system..Refer to the set rnat command for meanings of the arguments. Arguments Example
Related Commands clear rnat set rnat stat rnat show rnat
stat rnat
Synopsis stat rnat [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics for rnat sessions. Arguments Bytes Received (rnatRxBytes) Bytes received during RNAT sessions. Bytes Sent (rnatTxBytes) Bytes sent during RNAT sessions. Packets Received (rnatRxPkts) Packets received during RNAT sessions. Packets Sent (rnatTxPkts) Packets sent during RNAT sessions. Syn Sent (rnatTxSyn)
Requests for connections sent during RNAT sessions. Current RNAT sessions (rnatSessions) Currently active RNAT sessions. Example stat rnat
Related Commands clear rnat set rnat unset rnat show rnat stat vlan stat interface stat bridge stat rnatip
show rnat
Synopsis show rnat Description Display the Reverse NAT configuration. Arguments summary fullValues format level network The network address. netmask The subnet mask for the network address. natIP Nat IP Address. aclname An extended ACL defined for the RNAT entry. redirectPort Port number to which the packets are redirected. Applicable to TCP and UDP protocols count stateflag
Example
Related Commands clear rnat set rnat unset rnat stat rnat
set bridgetable
Synopsis set bridgetable -bridgeAge <positive_integer> Description Set the aging time for bridge table entries. Dynamic bridge entries are automatically removed after a specified period time (the "aging time") since the entry was created or last updated has elapsed. Arguments bridgeAge The time-out value for the bridge table entries, in seconds. The new value applies only to the entries that are dynamically learned after the new value is set. Previously existing bridge table entries expire after the previously configured time-out value. Minimum value: 60. Maximum value: 300. Default: 300. Default value: 300 Minimum value: 60 Maximum value: 300 Example set bridgetable -bridgeAge 200 Related Commands unset bridgetable show bridgetable clear bridgetable
unset bridgetable
Synopsis unset bridgetable -bridgeAge Description Use this command to remove bridgetable settings.Refer to the set bridgetable command for meanings of the arguments. Arguments Example
Related Commands set bridgetable
show bridgetable clear bridgetable
show bridgetable
Synopsis show bridgetable Description Display the bridge aging time and bridging table. Arguments summary fullValues format level bridgeAge The time-out value for the bridge table entries, in seconds. The new value applies only to the entries that are dynamically learned after the new value is set. Previously existing bridge table entries expire after the previously configured time-out value. Minimum value: 60. Maximum value: 300. Default: 300. mac The MAC address of the target. ifnum The interface on which the address was learned. vlan The VLAN in which this MAC address resides. channel The Tunnel through which bridge entry is learned. count stateflag Example show bridgetable Related Commands set bridgetable unset bridgetable clear bridgetable
clear bridgetable
Synopsis clear bridgetable [-vlan <positive_integer>] [-ifnum <interface_name>]
Description Remove entries from bridge table Arguments vlan VLAN whose entries are to be removed. ifnum INTERFACE whose entries are to be removed. Example
Related Commands set bridgetable unset bridgetable show bridgetable
stat bridge
Synopsis stat bridge [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display bridging statistics. Arguments Loops The number of times bridging registered MAC moved Collisions (Collisns) The number of bridging table collisions Interface muted (Mutes) The number of bridging related interface mutes Total brdiged packets (Tot_pkts) The total number of bridged packets Total brdiged Mbits (Tot_Mbits) The total number of bridged Mbits Example
Related Commands stat vlan stat interface stat rnat stat rnatip
set lacp
Synopsis set lacp -sysPriority <positive_integer> Description Set the LACP system priority. Arguments sysPriority LACP system priority Default value: 32768 Minimum value: 1 Maximum value: 65535 Example
Related Commands show lacp
show lacp
Synopsis show lacp Description Display the LACP configuration. Arguments format level deviceName Name of the channel. sysPriority LACP system priority mac LACP system MAC. flags Flags of this channel. lacpKey LACP key of this channel. clustersysPriority LACP system (Cluster) priority clusterMac LACP system (Cluster) mac. count stateflag
Example
Related Commands set lacp
set rnatparam
Synopsis set rnatparam -tcpproxy ( ENABLED | DISABLED ) Description Set the rnat parameter Arguments tcpproxy The state of tcpproxy. Possible values: ENABLED, DISABLED Default value: ENABLED Example set rnat parameter -tcpproxy ENABLED Related Commands unset rnatparam show rnatparam
unset rnatparam
Synopsis unset rnatparam -tcpproxy Description Use this command to remove rnatparam settings.Refer to the set rnatparam command for meanings of the arguments. Arguments Example
Related Commands set rnatparam show rnatparam
show rnatparam
Synopsis show rnatparam
Description Show the rnat parameter. Arguments format level tcpproxy The state of tcpproxy. Example show rnat parameter
Related Commands set rnatparam unset rnatparam
stat rnatip
Synopsis stat rnatip [<rnatip>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics for RNAT sessions. Arguments rnatip Specifies the NAT IP address of the configured RNAT entry for which you want to see the statistics. If you do not specify an IP address, this displays the statistics for all the configured RNAT entries. count devno stateflag Bytes Received (rxBytes) Bytes received on this IP address during RNAT sessions. Bytes Sent (txBytes) Bytes sent from this IP address during RNAT sessions. Packets Received (rxPkts) Packets received on this IP address during RNAT sessions. Packets Sent (txPkts) Packets sent from this IP address during RNAT sessions. Syn Sent (txSyn) Requests for connections sent from this IP address during RNAT sessions. Current RNAT sessions (sessions) Currently active RNAT sessions started from this IP address.
Example stat rnatip 1.1.1.1
Related Commands stat vlan stat interface stat rnat stat bridge
set vrIDParam
Synopsis set vrIDParam -sendToMaster ( ENABLED | DISABLED ) Description Set the VRID global settings on the NetScaler Arguments sendToMaster Forward packets to the master node, in an active-active mode configuration, if the virtual server is in the backup state and sharing is disabled. Possible values: ENABLED, DISABLED. Default: DISABLED. Possible values: ENABLED, DISABLED Default value: DISABLED Example set vrIDParam -sendToMaster ENABLED
Related Commands add vrid add vrid6 unset vrIDParam show vrIDParam
unset vrIDParam
Synopsis unset vrIDParam -sendToMaster Description Use this command to remove vrIDParam settings.Refer to the set vrIDParam command for meanings of the arguments. Arguments Example
Related Commands set vrIDParam show vrIDParam
show vrIDParam
Synopsis show vrIDParam Description Display the VRID global settings on the NetScaler appliance. Arguments format level sendToMaster Forward packets to the master node, in an active-active mode configuration, if the virtual server is in the backup state and sharing is disabled. Possible values: ENABLED, DISABLED. Default: DISABLED. Example
Related Commands unset vrIDParam
set ipv6
Synopsis set ipv6 [-ralearning ( ENABLED | DISABLED )] [-natprefix <ipv6_addr|*>] Description Set IPv6 specific parameters RA Learning and IPv6 NAT Prefix. Arguments ralearning Enable the NetScaler appliance to learn about various routes from RA and RS messages sent by the routers. Possible values: ENABLED, DISABLED Default value: DISABLED natprefix The prefix used for translating packets received from private IPv6 servers into IPv4 packets. This prefix has a length of 96 bits (128-32 = 96). The IPv6 servers embed the destination IP address of the IPv4 servers or hosts in the last 32 bits of the destination IP address field of the IPv6 packets. The first 96 bits of the destination IP address field are set as the IPv6 NAT prefix. IPv6 packets addressed to this prefix have to be routed to the NetScaler appliance to ensure that the IPv6-IPv4 translation is done by the appliance. Example set ipv6 -natprefix 2000::/96
Related Commands unset ipv6 show ipv6
unset ipv6
Synopsis unset ipv6 [-ralearning] [-natprefix] Description Use this command to remove ipv6 settings.Refer to the set ipv6 command for meanings of the arguments. Arguments Example
Related Commands set ipv6 show ipv6
show ipv6
Synopsis show ipv6 Description Display IPv6 settings Arguments format level flags IPv6 flags basereachtime ND6 base reachable time (ms) reachtime ND6 computed reachable time (ms) retransmissiontime ND6 retransmission time (ms) natprefix The prefix used for translating packets received from private IPv6 servers into IPv4 packets. This prefix has a length of 96 bits (128-32 = 96). The IPv6 servers embed the destination IP address of the IPv4 servers or hosts in the last 32 bits of the destination IP address field of the IPv6 packets. The first 96 bits of the destination IP address field are set as the IPv6 NAT prefix. IPv6 packets addressed to this prefix have to be routed to the NetScaler appliance to ensure that the IPv6-IPv4 translation is done by the appliance.
Example show ipv6 Related Commands set ipv6 unset ipv6
set ipTunnelParam
Synopsis set ipTunnelParam [-srcIP <ip_addr>] [-dropFrag ( YES | NO )] [-dropFragCpuThreshold <positive_integer>] [srcIPRoundRobin ( YES | NO )] Description Set the IP Tunnel global settings on the NetScaler Arguments srcIP The common source IP address for all tunnels. For a specific tunnel, this global setting is overridden if you have specified another source IP address. Must be a MIP or SNIP address. dropFrag Drop any IP packet that requires fragmentation before it is sent through the tunnel. Possible values: YES, NO Default value: NO dropFragCpuThreshold Threshold value, as a percentage of CPU usage, at which to drop packets that require fragmentation to use the IP tunnel. Applies only if dropFrag paramenter is set to NO. Minimum value: 1. Maximum value: 100. Default: 0 (not set). Minimum value: 1 Maximum value: 100 srcIPRoundRobin If the source IP is not configured, apply round-robin selection from the configured SNIPs. Possible values: YES, NO Default value: NO Example set ipTunnelParam -srcIP 10.100.20.48 -dropFrag YES -dropFragCpuThreshold 95 Related Commands add iptunnel rm iptunnel show iptunnel unset ipTunnelParam show ipTunnelParam
unset ipTunnelParam
Synopsis unset ipTunnelParam [-srcIP] [-dropFrag] [-dropFragCpuThreshold] [-srcIPRoundRobin]
Description Use this command to remove ipTunnelParam settings.Refer to the set ipTunnelParam command for meanings of the arguments. Arguments Example
Related Commands set ipTunnelParam show ipTunnelParam
show ipTunnelParam
Synopsis show ipTunnelParam Description Display the IP Tunnel global settings on the NetScaler Arguments format level srcIP The common source IP address for all tunnels. For a specific tunnel, this global setting is overridden if you have specified another source IP address. Must be a MIP or SNIP address. dropFrag Drop any IP packet that requires fragmentation before it is sent through the tunnel. dropFragCpuThreshold Threshold value, as a percentage of CPU usage, at which to drop packets that require fragmentation to use the IP tunnel. Applies only if dropFrag paramenter is set to NO. Minimum value: 1. Maximum value: 100. Default: 0 (not set). srcIPRoundRobin If the source IP is not configured, apply round-robin selection from the configured SNIPs. Example Tunnel Source IP: 10.100.20.48 Drop if Fragmentation Needed: YES CPU usage threshold to avoid fragmentation: 95 Related Commands add iptunnel rm iptunnel show iptunnel set ipTunnelParam unset ipTunnelParam
set ip6TunnelParam
Synopsis set ip6TunnelParam [-srcIP <ipv6_addr|null>] [-dropFrag ( YES | NO )] [-dropFragCpuThreshold <positive_integer>] [-srcIPRoundRobin ( YES | NO )] Description Set the IPv6 tunnel global settings on the NetScaler Arguments srcIP The source IP address used for all IPv6 tunnels, except those configured by using the add iptunnel command. dropFrag Drop an IPv6 packet if fragmentation is required to tunnel it. Possible values: YES, NO Default value: NO dropFragCpuThreshold Drop an IP6 packet if fragmentation is required to tunnel it and CPU usage is above this threshold. Minimum value: 1 Maximum value: 100 srcIPRoundRobin If the source IP address is not configured, apply round-robin selection from the configured SNIPs. Possible values: YES, NO Default value: NO Example set ip6TunnelParam -srcIP 9901::100 -dropFrag YES -dropFragCpuThreshold 95 Related Commands add ip6tunnel rm ip6tunnel show ip6tunnel unset ip6TunnelParam show ip6TunnelParam
unset ip6TunnelParam
Synopsis unset ip6TunnelParam [-srcIP] [-dropFrag] [-dropFragCpuThreshold] [-srcIPRoundRobin] Description Unset the IPv6 tunnel global settings on the NetScaler.Refer to the set ip6TunnelParam command for meanings of the arguments. Arguments Example unset ip6TunnelParam -srcIP -dropFrag -dropFragCpuThreshold
Related Commands add ip6tunnel rm ip6tunnel show ip6tunnel set ip6TunnelParam show ip6TunnelParam
show ip6TunnelParam
Synopsis show ip6TunnelParam Description Display the IPv6 Tunnel global settings on the NetScaler Arguments format level srcIP The source IP address used for all IPv6 tunnels, except those configured by using the add iptunnel command. dropFrag Drop an IPv6 packet if fragmentation is required to tunnel it. dropFragCpuThreshold Drop an IP6 packet if fragmentation is required to tunnel it and CPU usage is above this threshold. srcIPRoundRobin If the source IP address is not configured, apply round-robin selection from the configured SNIPs. Example Tunnel Source IP: 9901::100 Drop if Fragmentation Needed: YES CPU usage threshold to avoid fragmentation: 95 Related Commands add ip6tunnel rm ip6tunnel show ip6tunnel set ip6TunnelParam unset ip6TunnelParam
set L2Param
Synopsis set L2Param [-mbfPeermacUpdate <positive_integer>] [-maxBridgeCollision <positive_integer>] [-bdggrpProxyArp ( ENABLED | DISABLED )] [-bdgSetting ( ENABLED | DISABLED )] [-garpOnVridIntf ( ENABLED |
DISABLED )] [-macModeFwdMyPkt ( ENABLED | DISABLED )] [-useMyMAC ( ENABLED | DISABLED )] [proxyArp ( ENABLED | DISABLED )] [-garpReply ( ENABLED | DISABLED )] [-mbfInstLearning ( ENABLED | DISABLED )] [-rstIntfOnHaFo ( ENABLED | DISABLED )] [-skipProxyingBsdTraffic ( ENABLED | DISABLED )] Description Set Layer 2 related global settings on the NetScaler Arguments mbfPeermacUpdate When mbf_instant_learning is enabled, learn any changes in peer's MAC after this time interval, which is in 10ms ticks. Default value: 10 maxBridgeCollision Maximum bridge collision for loop detection Default value: 20 bdggrpProxyArp Set/reset proxy ARP in bridge group deployment Possible values: ENABLED, DISABLED Default value: ENABLED bdgSetting Bridging settings for C2C behavior Possible values: ENABLED, DISABLED Default value: DISABLED garpOnVridIntf Send GARP messagess on VRID-configured interfaces upon failover Possible values: ENABLED, DISABLED Default value: ENABLED macModeFwdMyPkt MAC mode vserver forward packets destined to VIPs. Possible values: ENABLED, DISABLED Default value: DISABLED useMyMAC Set/reset cfg_use_my_mac Possible values: ENABLED, DISABLED Default value: DISABLED proxyArp Set/reset cfg_proxy_arp_dr Possible values: ENABLED, DISABLED Default value: ENABLED garpReply Set/reset REPLY form of GARP Possible values: ENABLED, DISABLED Default value: DISABLED mbfInstLearning Enable instant learning of MAC changes in MBF mode. Possible values: ENABLED, DISABLED Default value: DISABLED rstIntfOnHaFo Enable the reset interface upon HA failover. Possible values: ENABLED, DISABLED Default value: DISABLED skipProxyingBsdTraffic Enable the proxying of FreeBSD traffic. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands unset l2param
show l2param unset L2Param show L2Param
unset L2Param
Synopsis unset L2Param [-mbfPeermacUpdate] [-maxBridgeCollision] [-bdggrpProxyArp] [-bdgSetting] [-garpOnVridIntf] [-macModeFwdMyPkt] [-useMyMAC] [-proxyArp] [-garpReply] [-mbfInstLearning] [-rstIntfOnHaFo] [skipProxyingBsdTraffic] Description Use this command to remove L2Param settings.Refer to the set L2Param command for meanings of the arguments. Arguments Example
Related Commands set L2Param show L2Param
show L2Param
Synopsis show L2Param Description Set Layer 2 related global settings on the NetScaler Arguments format level maxBridgeCollision Maximum bridge collision for loop detection mbfPeermacUpdate When mbf_instant_learning is enabled, learn any changes in peer's MAC after this time interval, which is in 10ms ticks. bdggrpProxyArp Set/reset proxy ARP in bridge group deployment bdgSetting Bridging settings for C2C behavior garpOnVridIntf Send GARP messagess on VRID-configured interfaces upon failover macModeFwdMyPkt
MAC mode vserver forward packets destined to VIPs. useMyMAC Set/reset cfg_use_my_mac proxyArp Set/reset cfg_proxy_arp_dr garpReply Set/reset REPLY form of GARP mbfInstLearning Enable instant learning of MAC changes in MBF mode. rstIntfOnHaFo Enable the reset interface upon HA failover. skipProxyingBsdTraffic Enable the proxying of FreeBSD traffic. Example
Related Commands unset l2param show l2param set L2Param unset L2Param
set L3Param
Synopsis set L3Param [-srcnat ( ENABLED | DISABLED )] [-icmpGenRateThreshold <positive_integer>] [-overrideRnat ( ENABLED | DISABLED )] [-dropDFFlag ( ENABLED | DISABLED )] [-mipRoundRobin ( ENABLED | DISABLED )] [-externalLoopBack ( ENABLED | DISABLED )] [-tnlPmtuWoConn ( ENABLED | DISABLED )] [usipServerStrayPkt ( ENABLED | DISABLED )] [-forwardICMPFragments ( ENABLED | DISABLED )] Description Set Layer 3 related global settings on the NetScaler Arguments srcnat Perform NAT if only the source is in the private network Possible values: ENABLED, DISABLED Default value: ENABLED icmpGenRateThreshold NS generated ICMP pkts per 10ms rate threshold Default value: 100 overrideRnat USNIP/USIP settings override RNAT settings for configured service/virtual server traffic.. Possible values: ENABLED, DISABLED Default value: DISABLED dropDFFlag Enable dropping the IP DF flag. Possible values: ENABLED, DISABLED Default value: DISABLED
mipRoundRobin Enable round robin usage of mapped IPs. Possible values: ENABLED, DISABLED Default value: ENABLED externalLoopBack Enable external loopback. Possible values: ENABLED, DISABLED Default value: DISABLED tnlPmtuWoConn Enable external loopback. Possible values: ENABLED, DISABLED Default value: ENABLED usipServerStrayPkt Enable detection of stray server side pkts in USIP mode. Possible values: ENABLED, DISABLED Default value: DISABLED forwardICMPFragments Enable forwarding of ICMP fragments. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands unset l3param show l3param unset L3Param show L3Param
unset L3Param
Synopsis unset L3Param [-srcnat] [-icmpGenRateThreshold] [-overrideRnat] [-dropDFFlag] [-mipRoundRobin] [externalLoopBack] [-tnlPmtuWoConn] [-usipServerStrayPkt] [-forwardICMPFragments] Description Use this command to remove L3Param settings.Refer to the set L3Param command for meanings of the arguments. Arguments Example
Related Commands set L3Param show L3Param
show L3Param
Synopsis show L3Param
Description Get Layer 3 related global settings on the NetScaler Arguments format level srcnat Perform NAT if only the source is in the private network icmpGenRateThreshold NS generated ICMP pkts per 10ms rate threshold overrideRnat USNIP/USIP settings override RNAT settings for configured service/virtual server traffic.. dropDFFlag Enable dropping the IP DF flag. mipRoundRobin Enable round robin usage of mapped IPs. externalLoopBack Enable external loopback. tnlPmtuWoConn Enable external loopback. usipServerStrayPkt Enable detection of stray server side pkts in USIP mode. forwardICMPFragments Enable forwarding of ICMP fragments. Example
Related Commands unset l3param show l3param set L3Param unset L3Param
add forwardingSession
Synopsis add forwardingSession <name> ((<network> <netmask>) | -aclname <string>) [-connfailover ( ENABLED | DISABLED )] Description Configure a forwarding session on the appliance. Arguments name
Name of forwarding session. network The network or subnet from/to which the traffic is flowing. aclname The ACL name. connfailover Specifies the connection failover mode of the forwarding session. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands set forwardingSession rm forwardingSession show forwardingSession
set forwardingSession
Synopsis set forwardingSession <name> [-connfailover ( ENABLED | DISABLED )] Description Set the configured forwarding session. Arguments name Name of forwarding session. connfailover Specifies the connection failover mode of the forwarding session. Possible values: ENABLED, DISABLED Default value: DISABLED Example set forwardsession fw1 -connfailover enabled.
Related Commands add forwardingSession rm forwardingSession show forwardingSession
rm forwardingSession
Synopsis rm forwardingSession <name>
Description Remove the configured forwarding session. Arguments name Name of forwarding session. Example rm forwardsession name. Related Commands add forwardingSession set forwardingSession show forwardingSession
show forwardingSession
Synopsis show forwardingSession [<name>] Description Display the forwarding-session configuration. Arguments name Name of forwarding session. format level network The network or subnet from/to which the traffic is flowing. netmask The subnet mask for the network. aclname The ACL name. connfailover Specifies the connection failover mode of the forwarding session. count stateflag Example
Related Commands add forwardingSession set forwardingSession
rm forwardingSession
add rnat6
Synopsis add rnat6 <name> (<network> | (<acl6name> [-redirectPort <port>])) Description Add a rnat6 entry Arguments name Name of the RNAT6. network ipv6 network address for rnat with prefix len CIDR notations (<ipv6 address>/<prefix len>) acl6name The acl6 name. Example add rnat6 rnat6_name 2002::/64
Related Commands bind rnat6 unbind rnat6 set rnat6 unset rnat6 clear rnat6 show rnat6
bind rnat6
Synopsis bind rnat6 <name> <natIP6>@ ... Description Bind RNAT IP6 address to RNAT^ entry Arguments name Name of the RNAT6. natIP6 One or more IP addresses to be bound to the IP set. Example bind rnat6 <rnat6_name> <natIP6>@ ...
Related Commands add rnat6 unbind rnat6 set rnat6 unset rnat6 clear rnat6 show rnat6
unbind rnat6
Synopsis unbind rnat6 <name> <natIP6>@ ... Description Unbind an IP address to an IP set. Arguments name Name of the RNAT6. natIP6 One or more IP addresses to be unbound from the rnat6 entry. Example unbind rnat6 <rnat6_name> <natIP6>@ ...
Related Commands add rnat6 bind rnat6 set rnat6 unset rnat6 clear rnat6 show rnat6
set rnat6
Synopsis set rnat6 <name> [-redirectPort <port>] Description Set the rnat6 parameters for a rnat6 config Arguments name Name of the RNAT6.
redirectPort The redirect port. Minimum value: 1 Maximum value: 65535 Example
Related Commands add rnat6 bind rnat6 unbind rnat6 unset rnat6 clear rnat6 show rnat6
unset rnat6
Synopsis unset rnat6 <name> [-redirectPort] Description Configure Reverse ipv6 NAT on the system..Refer to the set rnat6 command for meanings of the arguments. Arguments Example
Related Commands add rnat6 bind rnat6 unbind rnat6 set rnat6 clear rnat6 show rnat6
clear rnat6
Synopsis clear rnat6 <name> Description Configure Reverse ipv6 NAT on the system. Arguments name
Name of the RNAT6. Example
Related Commands add rnat6 bind rnat6 unbind rnat6 set rnat6 unset rnat6 show rnat6
show rnat6
Synopsis show rnat6 [<name>] Description Display the Reverse NAT configuration. Arguments name Name of the RNAT6. format level network The network address. acl6name ACL6 name natIP6 Nat IP Address. redirectPort Redirect Port Value stateflag count Example
Related Commands add rnat6 bind rnat6
unbind rnat6 set rnat6 unset rnat6 clear rnat6
Chapter
27
Ns Commands
Topics: shutdown reboot config ns stat ns add ns limitIdentifier rm ns limitIdentifier set ns limitIdentifier unset ns limitIdentifier show ns limitIdentifier add ns limitSelector rm ns limitSelector set ns limitSelector unset ns limitSelector show ns limitSelector add ns acl rm ns acl set ns acl unset ns acl enable ns acl disable ns acl stat ns acl rename ns acl show ns acl add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6 rename ns acl6 show ns acl6 add ns ip6 rm ns ip6 set ns ip6 unset ns ip6
814 | Citrix NetScaler 10 | Ns Commands
show ns ip6 add ns ip rm ns ip set ns ip unset ns ip enable ns ip disable ns ip show ns ip add ns simpleacl clear ns simpleacl rm ns simpleacl flush ns simpleacl show ns simpleacl stat ns simpleacl add ns simpleacl6 clear ns simpleacl6 flush ns simpleacl6 rm ns simpleacl6 show ns simpleacl6 stat ns simpleacl6 add ns pbr rm ns pbr set ns pbr unset ns pbr enable ns pbr disable ns pbr stat ns pbr show ns pbr add ns xmlnamespace rm ns xmlnamespace set ns xmlnamespace unset ns xmlnamespace show ns xmlnamespace add ns tcpProfile rm ns tcpProfile set ns tcpProfile unset ns tcpProfile show ns tcpProfile add ns httpProfile rm ns httpProfile set ns httpProfile unset ns httpProfile show ns httpProfile add ns appflowCollector rm ns appflowCollector show ns appflowCollector show ns stats show ns ns.conf
Citrix NetScaler 10 | Ns Commands | 815
show ns savedConfig show ns runningConfig renumber ns acls clear ns acls apply ns acls show ns info show ns license show ns version clear ns config set ns config unset ns config save ns config show ns config diff ns config set ns param unset ns param show ns param clear ns acls6 apply ns acls6 renumber ns acls6 renumber ns pbrs clear ns pbrs apply ns pbrs show ns connectiontable show ns limitSessions clear ns limitSessions show ns persistencesession clear ns persistencesession set ns hostName show ns hostName flush ns surgeQ enable ns feature disable ns feature show ns feature enable ns mode disable ns mode show ns mode set ns dhcpParams unset ns dhcpParams show ns dhcpParams release ns dhcpIp set ns spParams unset ns spParams show ns spParams set ns tcpbufParam unset ns tcpbufParam show ns tcpbufParam set ns tcpParam
unset ns tcpParam show ns tcpParam set ns httpParam unset ns httpParam show ns httpParam set ns weblogparam show ns weblogparam set ns rateControl unset ns rateControl show ns rateControl set ns rpcNode unset ns rpcNode show ns rpcNode set ns idletimeout unset ns idletimeout show ns idletimeout set ns timeout unset ns timeout show ns timeout show ns hardware show ns events set ns encryptionParams show ns encryptionParams show ns rollbackcmd stat ns memory set ns appflowParam unset ns appflowParam show ns appflowParam add ns pbr6 renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6 clear ns pbr6 apply ns pbr6
shutdown
Synopsis shutdown Description Use this command to stop the operations of the system on which you are issuing this command. After you enter this command, you can turn off power to the system. Notes 1. When a standalone system is rebooted, all configuration changes made since the last save ns config command was issued are lost. 2. In High Availability mode, on running this command on the primary system, the secondary system takes over and will have the configuration changes made since the last time that the save ns config command was issued on the primary system. In this case, log on to the new primary system, then issue the save ns config CLI command to save these changes. Arguments Example Related Commands
reboot
Synopsis reboot [-warm] Description Use this command to restart a system. Notes: 1. When a standalone system is rebooted, all configuration changes made since the last save ns config command was issued are lost. 2. In High Availability mode, on running this command on the primary system, the secondary system takes over and will have the configuration changes made since the last time that the save ns config command was issued on the primary system. In this case, log on to the new primary system, then issue the save ns config CLI command to save these changes. 3. On nCore systems, NetScaler will restart without rebooting the system if the 'warm' option is specified. The CLI session will terminate and the user will not be able to log back into the system until the restart has completed. Arguments warm When specified on nCore systems, the command restarts the NetScaler without requiring a system reboot. On Classic systems, this flag is ignored. Example Related Commands
config ns
Synopsis config ns Description Use this command to display the system's configuration menu. By choosing items from the menu and following the instructions on the screen, each of the configuration parameters can be modified. On entering the config CLI command, the following menu is displayed: Note: The values inside the square brackets indicate the current value of the parameters. > config ns NSCONFIG NS6.1. Reading the system configuration from the file /etc/ns.conf REVIEW CONFIGURATION PARAMETERS MENU ------------------------------------ This menu allows you to view and/or modify the system's configuration. Each configuration parameter displays its current value within brackets if it has been set. To change a value, enter the number that is displayed next to it. ------------------------------------ 1. System's
IP address: [10.102.7.101] 2. Netmask: [255.255.255.0] 3. Advanced Network Configuration. 4. Time zone. 5. Cancel all the changes and exit. 6. Apply changes and exit. Select a menu item from 1 to 6 [6]: System is running. Writing the System configuration into the file /etc/ns.conf System must be rebooted to apply configuration changes. Do you want to reboot System now? [NO]: Done Notes: 1. The system needs to be rebooted every time an item on this menu is changed and the changes saved. 2. This command only modifies and saves the basic configuration set in the ns.conf file (using the set ns config command). It does not save the running configuration changes applied after the last invocation of the save ns config command. If you have applied changes to your running configuration, then you should save them with save ns config command before using the config ns command. See the note on the reboot ns command. Arguments Example Related Commands stat ns
stat ns
Synopsis stat ns [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display general system statistics. Arguments Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system. Maximum memory(KB) Deprecated (MaxMem) Largest amount of memory the NetScaler can dedicate to caching, up to 50% of available memory. A 0 value disables caching, but the caching module continues to run. Delta compression ratio (DlCmpRt) Ratio of compressible data received to compressed data transmitted.If this ratio is one (uncmp:1.0) that means compression is disabled or we are not able to compress even a single compressible packet. Average CPU usage (CPU) Average CPU utilization percentage. CPU usage (CPU) CPU utilization percentage. Memory usage (MemUsage) Percentage of memory utilization on NetScaler. Total HTTP compression ratio Ratio of total HTTP data received to total HTTP data transmitted. HTTP compression ratio Ratio of the compressible data received from the server to the compressed data sent to the client. Utilized memory(KB) (UtiMem) Amount of memory the integrated cache is currently using. Maximum memory active value(KB) (MaxMemActive) Currently active value of maximum memory Maximum memory(KB) (Max64Mem)
Largest amount of memory the NetScaler can dedicate to caching, up to 50% of available memory. A 0 value disables caching, but the caching module continues to run. Origin bandwidth saved(%) (POrBan) Percentage of origin bandwidth saved, expressed as number of bytes served from the integrated cache divided by all bytes served. The assumption is that all compression is done in the NetScaler. Misses (TotMiss) Intercepted HTTP requests requiring fetches from origin server. Hits (TotHit) Responses served from the integrated cache. These responses match a policy with a CACHE action. # SSL cards UP (SSLCardUP) Number of SSL cards that are UP. If the number of cards UP is lower than a threshold, a failover is initiated. InUse Memory (%) (MemUsage) Percentage of memory utilization on NetScaler. Memory usage (MB) (MemUseMB) Main memory currently in use, in megabytes. Management CPU usage (%) (CPU) Management CPU utilization percentage. Packet CPU usage (%) (CPU) Packet CPU utilization percentage. Average CPU usage (%) (CPU) Average CPU utilization percentage. CPU usage (%) (CPU) CPU utilization percentage. Up since (Since) Time when the NetScaler appliance was last started. Last Transition time (TransTime) Time when the last master state transition occurred. You can use this statistic for debugging. System state (HAState) State of the HA node, based on its health, in a high availability setup. Possible values are: UP - Indicates that the node is accessible and can function as either a primary or secondary node. DISABLED - Indicates that the high availability status of the node has been manually disabled. Synchronization and propagation cannot take place between the peer nodes. INIT - Indicates that the node is in the process of becoming part of the high availability configuration. PARTIALFAIL - Indicates that one of the high availability monitored interfaces has failed because of a card or link failure. This state triggers a failover. COMPLETEFAIL - Indicates that all the interfaces of the node are unusable, because the interfaces on which high availability monitoring is enabled are not connected or are manually disabled. This state triggers a failover. DUMB - Indicates that the node is in listening mode. It does not participate in high availability transitions or transfer configuration from the peer node. This is a configured value, not a statistic. PARTIALFAILSSL - Indicates that the SSL card has failed. This state triggers a failover. ROUTEMONITORFAIL - Indicates that the route monitor has failed. This state triggers a failover. Master state (mastate) Indicates the high availability state of the node. Possible values are: STAYSECONDARY Indicates that the selected node remains the secondary node in a high availability setup. In this case a forced failover does not change the state but, instead, returns an appropriate error message. This is a configured value and not a statistic. PRIMARY - Indicates that the selected node is the primary
node in a high availability setup. SECONDARY - Indicates that the selected node is the secondary node in a high availability setup. CLAIMING - Indicates that the secondary node is in the process of taking over as the primary node. This is the intermediate state in the transition of the secondary node to primary status. FORCE CHANGE - Indicates that the secondary node is forcibly changing its status to primary due to a forced failover issued on the secondary node. # SSL cards present (SSLCards) Number of SSL crypto cards present on the NetScaler appliance. /flash Used (%) (disk0PerUsage) Used space in /flash partition of the disk, as a percentage. This is a critical counter. You can configure /flash Used (%) by using the Set snmp alarm DISK-USAGE-HIGH command. /var Used (%) (disk1PerUsage) Used space in /var partition of the disk, as a percentage. This is a critical counter. You can configure /var Used (%) by using the Set snmp alarm DISK-USAGE-HIGH command. /flash Available (MB) (disk0Avail) Available space in /flash partition of the hard disk. /var Available (MB) (disk1Avail) Available space in /var partition of the hard disk. Megabits received (RxMb) Number of megabytes received by the NetScaler appliance. Megabits transmitted (TxMb) Number of megabytes transmitted by the NetScaler appliance. All client connections (CltCx) Client connections, including connections in the Opening, Established, and Closing state. Established client connections (CltCxE) Current client connections in the Established state, which indicates that data transfer can occur between the NetScaler and the client. All server connections (SvrCx) Server connections, including connections in the Opening, Established, and Closing state. Established server connections (SvrCxE) Current server connections in the Established state, which indicates that data transfer can occur between the NetScaler and the server. Total requests (HTReqRx) Total number of HTTP requests received. Total responses (HTRspRx) Total number of HTTP responses sent. Request bytes received (HTReqbRx) Total number of bytes of HTTP request data received. Response bytes received (HTRspbRx) Total number of bytes of HTTP response data received. SSL transactions (SSLTrn) Number of SSL transactions on the NetScaler appliance. SSL session hits (SeHit) Number of SSL session reuse hits on the NetScaler appliance. requests (reqs)
HTTP/HTTPS requests sent to your protected web servers via the Application Firewall. responses (resps) HTTP/HTTPS responses sent by your protected web servers via the Application Firewall. aborts Incomplete HTTP/HTTPS requests aborted by the client before the Application Firewall could finish processing them. redirects (redirect) HTTP/HTTPS requests redirected by the Application Firewall to a different Web page or web server. (HTTP 302) Misc. Counter 0 (misc0) Miscellaneous Counter 0. Misc. Counter 1 (misc1) Miscellaneous Counter 1. Misc. Counter 2 (misc2) Miscellaneous Counter 2. Misc. Counter 3 (misc3) Miscellaneous Counter 3. CPU usage (CPU) CPU utilization: percentage * 10. Management CPU usage (CPU) Management CPU utilization: percentage * 10. SSL crypto card status (SSLCardSt) Status of the SSL card(s). The value should be interpreted in binary form, with each set bit indicates a card as UP. 304 hits (304Hit) Object not modified responses served from the cache. (Status code 304 served instead of the full response.) Non-304 hits (Non304Hit) Total number of full (non-304) responses served from the cache. A 304 status code indicates that a response has not been modified since the last time it was served Requests (CacReq) Total cache hits plus total cache misses. Compressed bytes transmitted Number of bytes the NetScaler sends to the client after compressing the response from the server. Compressible bytes received Number of bytes that can be compressed, which the NetScaler receives from the server. This gives the content length of the response that the NetScaler receives from server. Compressible bytes received (DlCmpRxB) Total number of delta-compressible bytes received by NetScaler. Compressed bytes transmitted (DlCmpTxB) Total number of delta-compressed bytes transmitted by NetScaler. Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system.
Example
Related Commands config ns stat ns acl stat ns acl6 stat ns simpleacl stat ns simpleacl6 stat ns pbr stat ns memory stat ns pbr6
add ns limitIdentifier
Synopsis add ns limitIdentifier <limitIdentifier> [-threshold <positive_integer>] [-timeSlice <positive_integer>] [-mode <mode> [-limitType ( BURSTY | SMOOTH )]] [-selectorName <string>] [-maxBandwidth <positive_integer>] [trapsInTimeSlice <positive_integer>] Description Create a limit identifier. Arguments limitIdentifier The name of rate limit identifier. threshold The maximum number of requests that are allowed in the given timeslice when requests are tracked per timeslice. When connections (-mode CONNECTION)are tracked its the total number of connections that would be let through Default value: 1 Minimum value: 1 timeSlice Defines the time interval in msecs specified in multiples of 10 msec during which the requests are tracked to see if they cross the threshold. It is used only when the mode is REQUEST_RATE while tracking request rate and for defining the trap timeslice Default value: 1000 Minimum value: 10 mode Defines what is tracked - request rate, connections or none. Request rate is used to track requests/ timeslice, connections will track active transactions. For DNS please use the mode as either NONE or REQUEST_RATE as CONNECTION is not supported. Eg: 1) add limitidentifier limit_req mode request_rate -limitType smooth -timeslice 1000 -Threshold 2000 -trapsInTimeSlice 200 will permit 20 requests in 10 ms and 2 Traps in 10 ms 2) set limitidentifier limit_req -timeslice 1000 -Threshold 5000 -limitType smooTH will permit 50 Requests in 10 ms 3) set limitidentifier limit_req -mode smooth -timeslice 2000 -Threshold 50 will permit 1 request in 40 ms 4) set limitidentifier limit_req -timeslice 1000 -Threshold 5 -limitType smooth -trapsInTimeSlice 8 will permit 1 request in 200 ms and 1 Trap in 130 ms 5) set limitidentifier limit_req -timeslice 1000 -Threshold 5000 -limitType BURSTY will permit 5000 Requests in 1000 ms and 200 Traps in 1000 ms As you see in the above examples smooth mode is used when one wants the permitted number of requests in a given interval of time to be spread evenly across the timeslice while
bursty is used when one is ok to let the permitted number of requests to exhaust the quota anytime within the timeslice. Possible values: CONNECTION, REQUEST_RATE, NONE Default value: PEMGMT_RLT_MODE_REQ_RATE limitType Specifies if it is a smooth or bursty request type. If the smooth mode of operation is chosen requests are tracked at the rate of 10 ms. To be specified with -mode REQUEST_RATE . Possible values: BURSTY, SMOOTH Default value: PEMGMT_RLT_REQ_RATE_TYPE_BURSTY selectorName The name of rate limit selector. maxBandwidth The maximum bandwidth permitted in kbps Maximum value: 4294967287 trapsInTimeSlice Number of traps that would be sent in the timeslice configured. A value of zero means that the traps are disabled. Maximum value: 65535 Example add ns limitIdentifier limit_id -threshold 2 -timeSlice 5000 -mode CONNECTION selectorName sel_1 -maxBandwidth 24 -trapsInTimeSlice 8
Related Commands rm ns limitIdentifier set ns limitIdentifier unset ns limitIdentifier show ns limitIdentifier
rm ns limitIdentifier
Synopsis rm ns limitIdentifier <limitIdentifier> Description The command deletes the rate limit identifier. Arguments limitIdentifier The name of rate limit identifier. Example rm ns limitIdentifier limit_id
Related Commands add ns limitIdentifier set ns limitIdentifier unset ns limitIdentifier show ns limitIdentifier
set ns limitIdentifier
Synopsis set ns limitIdentifier <limitIdentifier> [-threshold <positive_integer>] [-timeSlice <positive_integer>] [-mode <mode> [-limitType ( BURSTY | SMOOTH )]] [-selectorName <string>] [-maxBandwidth <positive_integer>] [trapsInTimeSlice <positive_integer>] Description set limit identifier params. Arguments limitIdentifier The name of rate limit identifier. threshold The maximum number of requests that are allowed in the given timeslice when requests are tracked per timeslice. When connections (-mode CONNECTION)are tracked its the total number of connections that would be let through Default value: 1 Minimum value: 1 timeSlice Defines the time interval in msecs specified in multiples of 10 msec during which the requests are tracked to see if they cross the threshold. It is used only when the mode is REQUEST_RATE while tracking request rate and for defining the trap timeslice Default value: 1000 Minimum value: 10 mode Defines what is tracked - request rate, connections or none. Request rate is used to track requests/ timeslice, connections will track active transactions. For DNS please use the mode as either NONE or REQUEST_RATE as CONNECTION is not supported. Eg: 1) add limitidentifier limit_req mode request_rate -limitType smooth -timeslice 1000 -Threshold 2000 -trapsInTimeSlice 200 will permit 20 requests in 10 ms and 2 Traps in 10 ms 2) set limitidentifier limit_req -timeslice 1000 -Threshold 5000 -limitType smooTH will permit 50 Requests in 10 ms 3) set limitidentifier limit_req -mode smooth -timeslice 2000 -Threshold 50 will permit 1 request in 40 ms 4) set limitidentifier limit_req -timeslice 1000 -Threshold 5 -limitType smooth -trapsInTimeSlice 8 will permit 1 request in 200 ms and 1 Trap in 130 ms 5) set limitidentifier limit_req -timeslice 1000 -Threshold 5000 -limitType BURSTY will permit 5000 Requests in 1000 ms and 200 Traps in 1000 ms As you see in the above examples smooth mode is used when one wants the permitted number of requests in a given interval of time to be spread evenly across the timeslice while bursty is used when one is ok to let the permitted number of requests to exhaust the quota anytime within the timeslice. Possible values: CONNECTION, REQUEST_RATE, NONE Default value: PEMGMT_RLT_MODE_REQ_RATE selectorName The name of rate limit selector. maxBandwidth The maximum bandwidth permitted in kbps Maximum value: 4294967287 trapsInTimeSlice Number of traps that would be sent in the timeslice configured. A value of zero means that the traps are disabled. Maximum value: 65535 Example set ns limitIdentifier limit_id -threshold 2 -timeSlice 5000 -mode CONNECTION -selectorName sel_1 -maxBandwidth 24 -trapsInTimeSlice 8 Related Commands add ns limitIdentifier
rm ns limitIdentifier unset ns limitIdentifier show ns limitIdentifier
unset ns limitIdentifier
Synopsis unset ns limitIdentifier <limitIdentifier> [-selectorName] [-threshold] [-timeSlice] [-mode] [-limitType] [maxBandwidth] [-trapsInTimeSlice] Description Use this command to remove ns limitIdentifier settings.Refer to the set ns limitIdentifier command for meanings of the arguments. Arguments Example Related Commands add ns limitIdentifier rm ns limitIdentifier set ns limitIdentifier show ns limitIdentifier
show ns limitIdentifier
Synopsis show ns limitIdentifier [<limitIdentifier>] Description Display rate limit identifiers. Arguments limitIdentifier The name of the rate limit identifier. summary fullValues format level threshold The maximum number of requests that are allowed in the given timeslice when requests are tracked per timeslice. When connections (-mode CONNECTION)are tracked its the total number of connections that would be let through timeSlice Defines the time interval in msecs specified in multiples of 10 msec during which the requests are tracked to see if they cross the threshold. It is used and displayed only when the mode is REQUEST_RATE while tracking request rate and for defining the trap timeslice. mode Defines what is tracked - request rate, connections or none. Request rate is used to track requests/ timeslice, connections will track active transactions. For DNS please use the mode as either NONE
or REQUEST_RATE as CONNECTION is not supported. Eg: 1) add limitidentifier limit_req mode request_rate -limitType smooth -timeslice 1000 -Threshold 2000 -trapsInTimeSlice 200 will permit 20 requests in 10 ms and 2 Traps in 10 ms 2) set limitidentifier limit_req -timeslice 1000 Threshold 5000 -limitType smooTH will permit 50 Requests in 10 ms 3) set limitidentifier limit_req -mode smooth -timeslice 2000 -Threshold 50 will permit 1 request in 40 ms 4) set limitidentifier limit_req -timeslice 1000 -Threshold 5 -limitType smooth -trapsInTimeSlice 8 will permit 1 request in 200 ms and 1 Trap in 130 ms 5) set limitidentifier limit_req -timeslice 1000 -Threshold 5000 limitType BURSTY will permit 5000 Requests in 1000 ms and 200 Traps in 1000 ms As you see in the above examples smooth mode is used when one wants the permitted number of requests in a given interval of time to be spread evenly across the timeslice while bursty is used when one is ok to let the permitted number of requests to exhaust the quota anytime within the timeslice. limitType Specifies if it is a smooth or bursty request type. If the smooth mode of operation is chosen requests are tracked at the rate of 10 ms. To be specified with -mode REQUEST_RATE . selectorName The name of rate limit selector. flags This is used internally to identify ip addresses returned. hits The number of times this identifier was evaluated. drop The number of times action was taken. rule Rule. time Time interval considered for rate limiting total Maximum number of requests permitted in the computed timeslice maxBandwidth The maximum bandwidth in kbps permitted trapsInTimeSlice The maximum bandwidth permitted in kbps trapsComputedInTimeSlice The number of traps that would be sent in the timeslice configured. computedTrapTimeSlice The time interval computed for sending traps. referenceCount Total number of transactions pointing to this entry. count stateflag Example show ns limitIdentifier limit_id
Related Commands add ns limitIdentifier rm ns limitIdentifier set ns limitIdentifier unset ns limitIdentifier
add ns limitSelector
Synopsis Description NOTE: This command is deprecated.Replaced by "stream selector" Arguments selectorName rule Example Related Commands rm ns limitSelector set ns limitSelector unset ns limitSelector show ns limitSelector
rm ns limitSelector
Synopsis Description NOTE: This command is deprecated.Replaced by "stream selector" Arguments selectorName Example Related Commands add ns limitSelector set ns limitSelector unset ns limitSelector show ns limitSelector
set ns limitSelector
Synopsis
Description NOTE: This command is deprecated. Arguments selectorName rule Example Related Commands add ns limitSelector rm ns limitSelector unset ns limitSelector show ns limitSelector
unset ns limitSelector
Synopsis Description Use this command to remove ns limitSelector settings.Refer to the set ns limitSelector command for meanings of the arguments.NOTE: This command is deprecated. Arguments Example Related Commands add ns limitSelector rm ns limitSelector set ns limitSelector show ns limitSelector
show ns limitSelector
Synopsis Description NOTE: This command is deprecated.Replaced by "stream selector" Arguments selectorName summary fullValues format level rule
flags count stateflag Example Related Commands add ns limitSelector rm ns limitSelector set ns limitSelector unset ns limitSelector
add ns acl
Synopsis add ns acl <aclname> <aclaction> [-srcIP [<operator>] <srcIPVal>] [-srcPort [<operator>] <srcPortVal>] [-destIP [<operator>] <destIPVal>] [-destPort [<operator>] <destPortVal>] [-TTL <positive_integer>] [-srcMac <mac_addr>] [(-protocol <protocol> [-established]) | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [-interface <interface_name>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-priority <positive_integer>] [state ( ENABLED | DISABLED )] [-logstate ( ENABLED | DISABLED ) [-ratelimit <positive_integer>]] Description Add an ACL to the System configuration. Each inbound packet is matched against configured ACLs and the specified action is applied to the packet. This command adds the acl to the configuration space. To commit this ACL, one should apply the ACL. Arguments aclname The alphanumeric name of the ACL. aclaction The action associated with the ACL. Possible values: BRIDGE, DENY, ALLOW srcIP The source IP address (range). srcPort The source Port (range). destIP The destination IP address (range). destPort The destination Port (range). TTL The time to expire this ACL(in seconds). Minimum value: 1 Maximum value: 2147483647 srcMac The source MAC address. protocol The IP protocol name. Possible values: ICMP, IGMP, TCP, EGP, IGP, ARGUS, UDP, RDP, RSVP, EIGRP, L2TP, ISIS
protocolNumber The IP protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan The VLAN number. Minimum value: 1 Maximum value: 4094 interface The physical interface. established This argument indicates that the ACL should be used for TCP response traffic only. icmpType The ICMP message type Maximum value: 255 icmpCode The ICMP message code Maximum value: 255 priority The priority of the ACL. Minimum value: 1 Maximum value: 100000 state The state of the ACL. Possible values: ENABLED, DISABLED Default value: XACLENABLED logstate The logging state of the ACL. Possible values: ENABLED, DISABLED Default value: GENDISABLED ratelimit log message rate limit for acl rule Default value: 100 Minimum value: 1 Maximum value: 10000 Example add ns acl restrict DENY -srcport 45-1024 -destIP 192.168.1.1 -protocol TCP Related Commands clear acls apply acls rm ns acl set ns acl unset ns acl enable ns acl disable ns acl stat ns acl rename ns acl show ns acl
rm ns acl
Synopsis rm ns acl <aclname> ... Description Remove an ACL. To commit this operation, one should apply the ACL.
Arguments aclname The name of the ACL to be deleted. Example rm ns acl restrict Related Commands apply acls clear acls add ns acl set ns acl unset ns acl enable ns acl disable ns acl stat ns acl rename ns acl show ns acl
set ns acl
Synopsis set ns acl <aclname> [-aclaction <aclaction>] [-srcIP [<operator>] <srcIPVal>] [-srcPort [<operator>] <srcPortVal>] [-destIP [<operator>] <destIPVal>] [-destPort [<operator>] <destPortVal>] [-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-vlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] [-logstate ( ENABLED | DISABLED )] [-ratelimit <positive_integer>] [-established] Description Modify an ACL. To commit this modified ACL, use the 'apply acls' command. Arguments aclname The alphanumeric name of the ACL. aclaction The action associated with the ACL. Possible values: BRIDGE, DENY, ALLOW srcIP The source IP address (range). srcPort The source Port (range). destIP The destination IP address (range). destPort The destination Port (range). srcMac The source MAC address.
protocol The IP protocol name. Possible values: ICMP, IGMP, TCP, EGP, IGP, ARGUS, UDP, RDP, RSVP, EIGRP, L2TP, ISIS protocolNumber The IP protocol number (decimal). Minimum value: 1 Maximum value: 255 icmpType The ICMP message type Maximum value: 255 vlan The VLAN number. Minimum value: 1 Maximum value: 4094 interface The physical interface. priority The priority of the ACL. Minimum value: 1 Maximum value: 100000 state The state of the ACL. Possible values: ENABLED, DISABLED Default value: XACLENABLED logstate The logging state of the ACL. Possible values: ENABLED, DISABLED Default value: GENDISABLED established This argument indicates that the ACL should be used for TCP response traffic only. Example set ns acl restrict -srcPort 50 Related Commands clear acls apply acls add ns acl rm ns acl unset ns acl enable ns acl disable ns acl stat ns acl rename ns acl show ns acl
unset ns acl
Synopsis unset ns acl <aclname> [-srcIP] [-srcPort] [-destIP] [-destPort] [-srcMac] [-protocol] [-icmpType] [-icmpCode] [vlan] [-interface] [-logstate] [-ratelimit] [-established] Description Modify an ACL. To commit this modified ACL, use the 'apply acls' command..Refer to the set ns acl command for meanings of the arguments.
Arguments Example unset ns acl rule1 -srcPort Related Commands set ns acl clear acls apply acls add ns acl rm ns acl enable ns acl disable ns acl stat ns acl rename ns acl show ns acl
enable ns acl
Synopsis enable ns acl <aclname> ... Description Enable an ACL. To commit this operation, one should apply the ACL. Arguments aclname The name of the ACL to be enabled. Example enable ns acl foo Related Commands apply acls clear acls add ns acl rm ns acl set ns acl unset ns acl disable ns acl stat ns acl rename ns acl show ns acl
disable ns acl
Synopsis disable ns acl <aclname> ... Description Disable an ACL. To commit this operation, one should apply the ACL. Arguments aclname The name of the ACL to be disabled. Example disable ns acl foo Related Commands apply acls clear acls add ns acl rm ns acl set ns acl unset ns acl enable ns acl stat ns acl rename ns acl show ns acl
stat ns acl
Synopsis stat ns acl [<aclname>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display ACL statistics. Arguments aclname The ACL. count devno stateflag Bridge ACL hits (ACLBdg) Packets matching a bridge ACL, which is in transparent mode and bypasses service processing. Deny ACL hits (ACLDeny) Packets dropped because they match ACLs with processing mode set to DENY. Allow ACL hits (ACLAllow) Packets matching ACLs with processing mode set to ALLOW. NetScaler processes these packets.
NAT ACL hits (ACLNAT) Packets matching a NAT ACL, resulting in a NAT session. ACL hits (ACLHits) Packets matching an ACL. ACL misses (ACLMiss) Packets not matching any ACL. Hits for this ACL (Hits) Number of times the acl was hit Example stat acl Related Commands add ns acl rm ns acl set ns acl unset ns acl enable ns acl disable ns acl rename ns acl show ns acl stat ns stat ns acl6 stat ns simpleacl stat ns simpleacl6 stat ns pbr stat ns memory stat ns pbr6
rename ns acl
Synopsis rename ns acl <aclname> <newName> Description Rename an ACL rule. Arguments aclname The name of the ACL rule. newName The new name of the ACL rule. Example rename acl rule rule-new
Related Commands add ns acl rm ns acl set ns acl unset ns acl enable ns acl disable ns acl stat ns acl show ns acl
show ns acl
Synopsis show ns acl [<aclname>] Description Display the ACLs.If name is specified, then only that particular ACL information is displayed. If it is not specified, all configured ACLs are displayed. Arguments aclname The name of the ACL. summary fullValues format level aclaction The action associated with the ACL. srcMac The source MAC address. stateflag ACL state flag. protocol The protocol number in IP header or name. protocolNumber The protocol number in IP header or name. srcPortVal The source Port (range). destPortVal The destination Port (range). srcIPVal The source IP address (range). destIPVal
The destination IP address (range). vlan The VLAN number. state The state of the ACL. TTL The time to expire this ACL(in seconds). icmpType The ICMP message type icmpCode The ICMP message code interface The physical interface. hits The hits of this ACL. established This flag indicates that the ACL should be used for TCP response traffic only. priority The priority of the ACL. operator Logical operator. operator Logical operator. operator Logical operator. operator Logical operator. kernelstate The commit status of the ACL. logstate The logging state of the ACL. ratelimit Packet rate limit for acl logging count Example sh acl foo Name: foo Action: ALLOW Hits: 0 srcIP = 10.102.1.150 destIP = 202.54.12.47 srcMac: Protocol: TCP srcPort destPort = 110 Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 1027 Related Commands add ns acl rm ns acl
set ns acl unset ns acl enable ns acl disable ns acl stat ns acl rename ns acl
add ns acl6
Synopsis add ns acl6 <acl6name> <acl6action> [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [-destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-TTL <positive_integer>] [-srcMac <mac_addr>] [(-protocol <protocol> [-established]) | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [-interface <interface_name>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] Description Add an IPv6 ACL to the System configuration. Each inbound packet is matched against configured ACLs and the specified action is applied to the packet. This command adds the IPv6 ACL to the configuration space. To commit this ACL, one should apply the ACL. Arguments acl6name Alphanumeric name of the ACL6. acl6action Action associated with the ACL6. Possible values: BRIDGE, DENY, ALLOW srcIPv6 Source IPv6 address (range). srcPort Source port (range). destIPv6 Destination IPv6 address (range). destPort Destination port (range). TTL Time to expire this ACL6 (in seconds). Minimum value: 1 Maximum value: 2147483647 srcMac Source MAC address. protocol IPv6 protocol name. Possible values: ICMPV6, TCP, UDP protocolNumber IPv6 protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan VLAN number. Minimum value: 1 Maximum value: 4094 interface Physical interface name.
established This argument indicates that the ACL6 should be used for TCP response traffic only. icmpType ICMPv6 message type Maximum value: 255 icmpCode ICMPv6 message code Maximum value: 255 priority Priority of the ACL6. (Sequence of execution) Minimum value: 1 Maximum value: 80000 state State of the ACL6. Possible values: ENABLED, DISABLED Default value: XACLENABLED Example add ns acl6 rule1 DENY -srcport 45-1024 -destIPv6 2001::45 -protocol TCP Related Commands clear ns acls6 apply ns acls6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6 rename ns acl6 show ns acl6
rm ns acl6
Synopsis rm ns acl6 <acl6name> ... Description Remove an ACL6. To commit this operation, one should apply the ACL6. Arguments acl6name Name of the ACL6 to be deleted. Example rm ns acl6 rule1 Related Commands apply ns acls6 clear ns acls6 add ns acl6
set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6 rename ns acl6 show ns acl6
set ns acl6
Synopsis set ns acl6 <acl6name> [-aclaction <aclaction>] [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [-destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-icmpType <positive_integer> [-icmpCode <positive_integer>]] [-vlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] [-established] Description Modify an ACL6. To commit this modified ACL6, use 'apply acls6' command. Arguments acl6name Alphanumeric name of the ACL6. aclaction Action associated with the ACL6. Possible values: BRIDGE, DENY, ALLOW srcIPv6 Source IPv6 address (range). srcPort Source Port (range). destIPv6 Destination IPv6 address (range). destPort Destination Port (range). srcMac Source MAC address. protocol IPv6 protocol name. Possible values: ICMPV6, TCP, UDP protocolNumber IPv6 protocol number (decimal). Minimum value: 1 Maximum value: 255 icmpType ICMPv6 message type Maximum value: 255 vlan VLAN number. Minimum value: 1 Maximum value: 4094 interface Physical interface name.
priority Priority of the ACL6. (Sequence of execution) Minimum value: 1 Maximum value: 80000 state State of the ACL6. Possible values: ENABLED, DISABLED Default value: XACLENABLED established This argument indicates that the ACL6 should be used for TCP response traffic only. Example set ns acl6 rule1 -srcPort 50 Related Commands clear ns acls6 apply ns acls6 add ns acl6 rm ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6 rename ns acl6 show ns acl6
unset ns acl6
Synopsis unset ns acl6 <acl6name> [-srcIPv6] [-srcPort] [-destIPv6] [-destPort] [-srcMac] [-protocol] [-icmpType] [icmpCode] [-vlan] [-interface] [-established] Description Modify an ACL6. To commit this modified ACL6, use 'apply acls6' command..Refer to the set ns acl6 command for meanings of the arguments. Arguments Example unset ns acl6 rule1 -srcPort Related Commands set ns acl6 clear ns acls6 apply ns acls6 add ns acl6 rm ns acl6 enable ns acl6 disable ns acl6
stat ns acl6 rename ns acl6 show ns acl6
enable ns acl6
Synopsis enable ns acl6 <acl6name> ... Description Enable an ACL6. To commit this operation, one should apply the ACL6. Arguments acl6name Name of the ACL6 to be enabled. Example enable ns acl6 rule1 Related Commands apply ns acls6 clear ns acls6 add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 disable ns acl6 stat ns acl6 rename ns acl6 show ns acl6
disable ns acl6
Synopsis disable ns acl6 <acl6name> ... Description Disable an ACL6. To commit this operation, one should apply the ACL6. Arguments acl6name Name of the ACL6 to be disabled. Example disable ns acl6 rule1 Related Commands apply ns acls6
clear ns acls6 add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 stat ns acl6 rename ns acl6 show ns acl6
stat ns acl6
Synopsis stat ns acl6 [<acl6name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display ACL6 statistics. Arguments acl6name ACL6 Name. count devno stateflag Bridge ACL6 hits (ACL6Bdg) Packets matching a bridge IPv6 ACL, which is in transparent mode and bypasses service processing. Deny ACL6 hits (ACL6Deny) Packets dropped because they match IPv6 ACLs with processing mode set to DENY. Allow ACL6 hits (ACL6Allow) Packets matching IPv6 ACLs with processing mode set to ALLOW. NetScaler processes these packets. NAT ACL6 hits (ACL6NAT) Packets matching a NAT ACL6, resulting in a NAT session. ACL6 hits (ACL6Hits) Packets matching an IPv6 ACL. ACL6 misses (ACL6Miss) Packets not matching any IPv6 ACL. Hits for this ACL6 (Hits) Number of times the acl6 was hit Example stat acl6
Related Commands add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 rename ns acl6 show ns acl6 stat ns stat ns acl stat ns simpleacl stat ns simpleacl6 stat ns pbr stat ns memory stat ns pbr6
rename ns acl6
Synopsis rename ns acl6 <acl6name> <newName> Description Rename an ACL6 rule. Arguments acl6name The name of the ACL6 rule. newName The new name of the ACL6 rule. Example rename acl6 rule rule-new Related Commands add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6
show ns acl6
show ns acl6
Synopsis show ns acl6 [<acl6name>] Description Display the ACL6. If name is specified, then only that particular ACL6 information is displayed. If it is not specified, all configured ACL6 are displayed. Arguments acl6name Name of the ACL6. summary fullValues format level acl6action Action associated with the ACL6. srcMac Source MAC address. stateflag ACL6 state flag. protocol Protocol number in IPv6 header or name. protocolNumber Protocol number in IPv6 header or name. srcPortVal Source Port (range). destPortVal Destination Port (range). srcIPv6Val Source IPv6 address (range). destIPv6Val Destination IPv6 address (range). vlan VLAN number. state State of the ACL6. kernelstate Commit status of the ACL6. TTL Time left to expire ACL6 (in seconds).
icmpType ICMPv6 message type icmpCode ICMPv6 message code interface Physical interface name. hits Number of hits of this ACL6. established This flag indicates that the ACL6 should be used for TCP response traffic only. priority Priority of the ACL6. (Sequence of execution) operator Logical operator. operator Logical operator. operator Logical operator. operator Logical operator. count Example show ns acl6 rule1 1) Name: r1 Action: DENY srcIPv6 = 2001::1 destIPv6 srcMac: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 Hits: 0 TTL: Related Commands add ns acl6 rm ns acl6 set ns acl6 unset ns acl6 enable ns acl6 disable ns acl6 stat ns acl6 rename ns acl6
add ns ip6
Synopsis add ns ip6 <IPv6Address>@ [-scope ( global | link-local )] [-type <type> [-hostRoute ( ENABLED | DISABLED ) [-ip6hostRtGw <ipv6_addr|*>] [-metric <integer>] [-vserverRHILevel <vserverRHILevel>] [-ospf6LSAType ( INTRA_AREA | EXTERNAL ) [-ospfArea <positive_integer>]]] ] [-nd ( ENABLED | DISABLED )] [-icmp
( ENABLED | DISABLED )] [-vServer ( ENABLED | DISABLED )] [-telnet ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-gui <gui>] [-ssh ( ENABLED | DISABLED )] [-snmp ( ENABLED | DISABLED )] [-mgmtAccess ( ENABLED | DISABLED )] [-restrictAccess ( ENABLED | DISABLED )] [dynamicRouting ( ENABLED | DISABLED )] [-state ( DISABLED | ENABLED )] [-map <ip_addr>] [-ownerNode <positive_integer>] Description Add an IPV6 address. Arguments IPv6Address The IPV6 address scope The scope of the IPV6 address Possible values: global, link-local Default value: NS_GLOBAL type The type of the IPV6 address. Possible values: NSIP, VIP, SNIP, GSLBsiteIP, ADNSsvcIP, CLIP Default value: NS_IPV6_SNIP nd Use this option to set (enable or disable) ND responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED icmp Use this option to set (enable or disable) ICMP responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED vServer Use this option to set (enable or disable) the vserver attribute for this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED telnet Use this option to set (enable or disable) the state of telnet access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED ftp Use this option to set (enable or disable) the state of ftp access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED gui Use this option to set (enable|Secureonly|disable) GUI access to this IP entity. Possible values: ENABLED, SECUREONLY, DISABLED Default value: ENABLED ssh Use this option to set (enable or disable) the state of SSH access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED snmp Use this option to set (enable or disable) the state of SNMP access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED mgmtAccess Use this option to set (enable or disable) the state of management access to this IP entity. Possible values: ENABLED, DISABLED Default value: DISABLED restrictAccess Enable or disable blocking of all ports not used for management access. Possible values: ENABLED, DISABLED Default value: DISABLED dynamicRouting
Use this option to enable or disable dynamic routing on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED hostRoute The state of advertisement of a hostroute to this IPv6 entity. Possible values: ENABLED, DISABLED ip6hostRtGw The gateway for the hostroute to be advertised for this IPv6 entity. metric The metric value to be added or subtracted from the cost of the hostroute advertised for this IP entity. Minimum value: -16777215 vserverRHILevel The state of per VIP RHI controls. Possible values: ONE_VSERVER, ALL_VSERVERS, NONE Default value: RHI_STATE_ONE ospf6LSAType The OSPF6's route advertisement type. Possible values: INTRA_AREA, EXTERNAL Default value: DISABLED ospfArea The area ID of the area in which OSPF intra area prefix LSAs should be advertised. Default value: -1 Maximum value: 4294967294LU state Use this option to enable or disable the entity. Possible values: DISABLED, ENABLED Default value: ENABLED map The mapped IPV4 address for IPV6. ownerNode The owner node in a Cluster for this IPv6 address. Default value: 255 Example add ns ip6 2001::a/96 -scope GLOBAL Related Commands rm ns ip6 set ns ip6 unset ns ip6 show ns ip6
rm ns ip6
Synopsis rm ns ip6 <IPv6Address>@ Description Remove an IPv6 entity. Arguments IPv6Address The IPV6 address of the entity.
Example rm ns ip6 2002::5 Related Commands add ns ip6 set ns ip6 unset ns ip6 show ns ip6
set ns ip6
Synopsis set ns ip6 <IPv6Address>@ [-nd ( ENABLED | DISABLED )] [-icmp ( ENABLED | DISABLED )] [-vServer ( ENABLED | DISABLED )] [-telnet ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-gui <gui>] [-ssh ( ENABLED | DISABLED )] [-snmp ( ENABLED | DISABLED )] [-mgmtAccess ( ENABLED | DISABLED )] [-restrictAccess ( ENABLED | DISABLED )] [-state ( DISABLED | ENABLED )] [-map <ip_addr>] [-dynamicRouting ( ENABLED | DISABLED )] [-hostRoute ( ENABLED | DISABLED ) [-ip6hostRtGw <ipv6_addr|*>] [-metric <integer>] [-vserverRHILevel <vserverRHILevel>] [-ospf6LSAType ( INTRA_AREA | EXTERNAL ) [-ospfArea <positive_integer>]]] Description Set IP6 address options. Arguments IPv6Address The IPV6 address nd The state of ND responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED icmp The state of ICMP responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED vServer The state of vserver attribute for this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED telnet The state of telnet access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED ftp The state of ftp access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED gui The state of GUI access to this IP entity. Possible values: ENABLED, SECUREONLY, DISABLED Default value: ENABLED ssh The state of SSH access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED snmp
The state of SNMP access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED mgmtAccess The state of management access to this IP entity. Possible values: ENABLED, DISABLED Default value: DISABLED restrictAccess Status of ports not used for management access (blocked/open) for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED state Use this option to enable or disable the entity. Possible values: DISABLED, ENABLED Default value: ENABLED map The mapped IPV4 address for IPV6. dynamicRouting Use this option to enable or disable dynamic routing on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED hostRoute The state of advertisement of a hostroute to this IPv6 entity. Possible values: ENABLED, DISABLED Example set ns ip6 2001::a -map 10.102.33.27 Related Commands add ns ip6 rm ns ip6 unset ns ip6 show ns ip6
unset ns ip6
Synopsis unset ns ip6 <IPv6Address>@ [-nd] [-icmp] [-vServer] [-telnet] [-ftp] [-gui] [-ssh] [-snmp] [-mgmtAccess] [restrictAccess] [-state] [-map] [-dynamicRouting] [-hostRoute] [-ip6hostRtGw] [-metric] [-vserverRHILevel] [ospf6LSAType] [-ospfArea] Description Use this command to remove ns ip6 settings.Refer to the set ns ip6 command for meanings of the arguments. Arguments Example
Related Commands add ns ip6 rm ns ip6 set ns ip6
show ns ip6
show ns ip6
Synopsis show ns ip6 [<IPv6Address>] Description Display all IPV6 addresses Arguments IPv6Address The IPV6 address summary fullValues format level scope The scope of the IPV6 address type The type of the IPV6 addressNOTE: This attribute is deprecated.This option is deprecated in favour of ip6_type ipType The type of the IPv6 address nd Whether ND is enabled or disabled. icmp Whether icmp is enabled or disabled. vServer Whether vserver is enabled or disabled. telnet Whether telnet is enabled or disabled. ssh Whether ssh is enabled or disabled. gui Whether gui is (enabled|SecureOnly|disabled). snmp Whether snmp is enabled or disabled. ftp Whether ftp is enabled or disabled. mgmtAccess Whether management access is enabled or disabled. restrictAccess Blocking of all ports not used for management access enabled or disabled
state The state of the IPV6 address map The mapped IPV4 address for IPV6. dynamicRouting Use this option to enable or disable dynamic routing on this IP address for the entity. hostRoute The state of advertisement of a hostroute to this IPv6 entity. ip6hostRtGw The gateway for the hostroute to be advertised for this IPv6 entity. metric The metric value to be added or subtracted from the cost of the hostroute advertised for this IPv6 entity. vserverRHILevel The state of per VIP RHI controls. VIPrtadv2BSD Whether this route is advertised to FreeBSD VIPvserCount Number of vservers bound to this VIP VIPvserDownCount Number of vservers bound to this VIP, which are down ospf6LSAType The OSPF's route advertisement type. ospfArea The area ID of the area in which OSPF INTRA AREA PREFIX LSAs should be advertised. ownerNode The owner node in a Cluster for this IPv6 address. stateflag cfgflags This contains the flags for IP in DB ipRefcount Used to keep reference count of IPv6 count Example show ns ip6
Related Commands add ns ip6 rm ns ip6 set ns ip6 unset ns ip6
add ns ip
Synopsis add ns ip <IPAddress>@ <netmask> [-type <type> [-hostRoute ( ENABLED | DISABLED ) [-hostRtGw <ip_addr>] [-metric <integer>] [-vserverRHILevel <vserverRHILevel>] [-ospfLSAType ( TYPE1 | TYPE5 ) [ospfArea <positive_integer>]]] ] [-arp ( ENABLED | DISABLED )] [-icmp ( ENABLED | DISABLED )] [-vServer ( ENABLED | DISABLED )] [-telnet ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-gui <gui>] [ssh ( ENABLED | DISABLED )] [-snmp ( ENABLED | DISABLED )] [-mgmtAccess ( ENABLED | DISABLED )] [-restrictAccess ( ENABLED | DISABLED )] [-dynamicRouting ( ENABLED | DISABLED )] [-state ( ENABLED | DISABLED )] [-vrID <positive_integer>] [-icmpResponse <icmpResponse>] [-ownerNode <positive_integer>] [arpResponse <arpResponse>] Description Add an IP address. Arguments IPAddress The IP address of the entity. netmask The netmask of the IP. type The type of the IP address. Possible values: SNIP, VIP, MIP, NSIP, GSLBsiteIP, CLIP Default value: NSADDR_SNIP arp Use this option to set (enable or disable) ARP and gratuitous ARP for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED icmp Use this option to set (enable or disable) ICMP responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED vServer Use this option to set (enable or disable) the vserver attribute for this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED telnet Use this option to set (enable or disable) the state of telnet access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED ftp Use this option to set (enable or disable) the state of ftp access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED gui Use this option to set (enable|Secureonly|disable) GUI access to this IP entity. Possible values: ENABLED, SECUREONLY, DISABLED Default value: ENABLED ssh Use this option to set (enable or disable) the state of SSH access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED snmp Use this option to set (enable or disable) the state of SNMP access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED mgmtAccess
Use this option to set (enable or disable) the state of management access to this IP entity. Possible values: ENABLED, DISABLED Default value: DISABLED restrictAccess Enable or disable blocking of all ports not used for management access. Possible values: ENABLED, DISABLED Default value: DISABLED dynamicRouting Use this option to enable or disable dynamic routing on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED ospf Use this option to enable or disable OSPF on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED bgp Use this option to enable or disable BGP on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED rip Use this option to enable or disable RIP on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED hostRoute The state of advertisement of a hostroute to this IP entity. Possible values: ENABLED, DISABLED hostRtGw The gateway for the hostroute to be advertised for this IP entity. Default value: -1 metric The metric value to be added or subtracted from the cost of the hostroute advertised for this IP entity. Minimum value: -16777215 vserverRHILevel The state of per VIP RHI controls. Possible values: ONE_VSERVER, ALL_VSERVERS, NONE Default value: RHI_STATE_ONE ospfLSAType The OSPF's route advertisement type. Possible values: TYPE1, TYPE5 Default value: DISABLED ospfArea The area ID of the area in which OSPF Type1 LSAs should be advertised. Default value: -1 Maximum value: 4294967294LU state Use this option to enable or disable the entity. Possible values: ENABLED, DISABLED Default value: ENABLED vrID Use this option to bind this IP to a VRID. Minimum value: 1 Maximum value: 255 icmpResponse ICMp response control on down vserver Possible values: NONE, ONE_VSERVER, ALL_VSERVERS, VSVR_CNTRLD Default value: NS_IP_NONE ownerNode The owner node in a Cluster for this IP address. 0 means IP is striped. Default value: 255 arpResponse Arp response control on down vserver Possible values: NONE, ONE_VSERVER, ALL_VSERVERS Default value: NS_IP_NONE
Example add ns ip 10.102.4.123 255.255.255.0
Related Commands rm ns ip set ns ip unset ns ip enable ns ip disable ns ip show ns ip
rm ns ip
Synopsis rm ns ip <IPAddress>@ Description Remove an IP entity. Arguments IPAddress The IP address of the entity. Example rm ns ip 10.102.4.123
Related Commands add ns ip set ns ip unset ns ip enable ns ip disable ns ip show ns ip
set ns ip
Synopsis set ns ip <IPAddress>@ [-netmask <netmask>] [-arp ( ENABLED | DISABLED )] [-icmp ( ENABLED | DISABLED )] [-vServer ( ENABLED | DISABLED )] [-telnet ( ENABLED | DISABLED )] [-ftp ( ENABLED | DISABLED )] [-gui <gui>] [-ssh ( ENABLED | DISABLED )] [-snmp ( ENABLED | DISABLED )] [mgmtAccess ( ENABLED | DISABLED )] [-restrictAccess ( ENABLED | DISABLED )] [-dynamicRouting ( ENABLED | DISABLED )] [-hostRoute ( ENABLED | DISABLED ) [-hostRtGw <ip_addr>] [-metric <integer>] [vserverRHILevel <vserverRHILevel>] [-ospfLSAType ( TYPE1 | TYPE5 ) [-ospfArea <positive_integer>]]] [-vrID <positive_integer>] [-icmpResponse <icmpResponse>] [-arpResponse <arpResponse>]
Description Set the attributes of an IP entity. Arguments IPAddress The IP address of the entity. netmask The netmask of the IP. arp The state of ARP and gratuitous ARP for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED icmp The state of ICMP responses for the entity. Possible values: ENABLED, DISABLED Default value: ENABLED vServer The state of vserver attribute for this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED telnet The state of telnet access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED ftp The state of ftp access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED gui The state of GUI access to this IP entity. Possible values: ENABLED, SECUREONLY, DISABLED Default value: ENABLED ssh The state of SSH access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED snmp The state of SNMP access to this IP entity. Possible values: ENABLED, DISABLED Default value: ENABLED mgmtAccess The state of management access to this IP entity. Possible values: ENABLED, DISABLED Default value: DISABLED restrictAccess Status of ports not used for management access (blocked/open) for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED dynamicRouting Use this option to enable or disable dynamic routing on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED ospf The state of OSPF on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED bgp The state of BGP on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED
rip The state of RIP on this IP address for the entity. Possible values: ENABLED, DISABLED Default value: DISABLED hostRoute The state of advertisement of a hostroute to this IP entity. Possible values: ENABLED, DISABLED vrID Use this option to bind this IP to a VRID. Minimum value: 1 Maximum value: 255 icmpResponse ICMp response control on down vserver Possible values: NONE, ONE_VSERVER, ALL_VSERVERS, VSVR_CNTRLD Default value: NS_IP_NONE arpResponse Arp response control on down vserver Possible values: NONE, ONE_VSERVER, ALL_VSERVERS Default value: NS_IP_NONE Example set ns ip 10.102.4.123 -arp ENABLED Related Commands add ns ip rm ns ip unset ns ip enable ns ip disable ns ip show ns ip
unset ns ip
Synopsis unset ns ip <IPAddress>@ [-netmask] [-arp] [-icmp] [-vServer] [-telnet] [-ftp] [-gui] [-ssh] [-snmp] [-mgmtAccess] [-restrictAccess] [-dynamicRouting] [-hostRoute] [-hostRtGw] [-metric] [-vserverRHILevel] [-ospfLSAType] [ospfArea] [-vrID] [-icmpResponse] [-arpResponse] Description Use this command to remove ns ip settings.Refer to the set ns ip command for meanings of the arguments. Arguments Example
Related Commands add ns ip rm ns ip set ns ip enable ns ip disable ns ip
show ns ip
enable ns ip
Synopsis enable ns ip <IPAddress>@ Description Enable an IP entity. Arguments IPAddress The IP address of the entity. Example enable ns ip 10.10.10.10 Related Commands add ns ip rm ns ip set ns ip unset ns ip disable ns ip show ns ip
disable ns ip
Synopsis disable ns ip <IPAddress>@ Description Disable an IP entity. Arguments IPAddress The IP address of the entity. Example disable ns ip 10.10.10.10 Related Commands add ns ip rm ns ip set ns ip unset ns ip enable ns ip show ns ip
show ns ip
Synopsis show ns ip [<IPAddress>] [-type <type>] Description Display all the IP addresses such as VIP,MIP,NSIP, and SNIP. Arguments IPAddress The IP address of the entity. type The type of this IP. Possible values: SNIP, VIP, MIP, NSIP, GSLBsiteIP, CLIP summary fullValues format level netmask The netmask of this IP. flags The flags for this entry. ipAttribute arp Whether arp is enabled or disabled. icmp Whether icmp is enabled or disabled. vServer Whether vserver is enabled or disabled. telnet Whether telnet is enabled or disabled. ssh Whether ssh is enabled or disabled. gui Whether gui is (enabled|SecureOnly|disabled). snmp Whether snmp is enabled or disabled. ftp Whether ftp is enabled or disabled. mgmtAccess Whether management access is enabled or disabled. restrictAccess Blocking of all ports not used for management access enabled or disabled dynamicRouting
Whether dynamic routing is enabled or disabled. bgp Whether bgp is enabled or disabled. ospf Whether ospf is enabled or disabled. rip Whether rip is enabled or disabled. hostRoute Whether host route is enabled or disabled. hostRtGw Gateway used for advertising host route. hostRtGwAct Actual Gateway used for advertising host route. metric The metric value added or subtracted from the cost of the hostroute. ospfArea The area ID of the area in which OSPF Type1 LSAs are advertised.NOTE: This attribute is deprecated.Replaced by ospfAreaval ospfAreaval The area ID of the area in which OSPF Type1 LSAs are advertised. vserverRHILevel The rhi level for this IP. VIPrtadv2BSD Whether this route is advertised to FreeBSD VIPvserCount Number of vservers bound to this VIP VIPvserDownCount Number of vservers bound to this VIP, which are down ospfLSAType The ospf lsa type to use while advertising this IP. state Whether this ip is enabled or disabled. freePorts Number of free Ports available on this IP vrID Use this option to bind this IP to a VRID. ipType icmpResponse ICMp response control on down vserver ownerNode The owner node in a Cluster for this IP address. 0 means IP is striped. arpResponse
Arp response control on down vserver stateflag cfgflags This contains the flags for IP in DB ipRefcount Used to keep reference count of IP count Example show ns ip Ipaddress Type Mode Arp Icmp Vserver State --------- ---- ---- --- ---- ------- ----1)10.102.4.123 NetScaler IP Active Enabled Enabled NA Enabled 2)10.102.4.237 MIP Passive Enabled Enabled NA Enabled 3)10.102.1.131 VIP Passive Enabled Enabled Enabled Enabled Related Commands add ns ip rm ns ip set ns ip unset ns ip enable ns ip disable ns ip
add ns simpleacl
Synopsis add ns simpleacl <aclname> <aclaction> -srcIP <ip_addr> [-destPort <port> -protocol ( TCP | UDP )] [-TTL <positive_integer>] Description Add a SimpleACL rule to the system configuration, every inbound packet is matched against configured SimpleACL rules and specified action is applied. Arguments aclname Alphanumeric name of the ACL rule. aclaction Action associated with the ACL rule. Possible values: DENY srcIP Source ip for the ACL rule. destPort Destination port for the ACL rule. TTL Time to expire this ACL rule(in seconds). Timer granularity is 4 seconds. Minimum value: 4 Maximum value: 2147483647 Example add simpleacl rule1 DENY -srcIP 1.1.1.1 -destPort 80 -protocol TCP add simpleacl rule2 DENY -srcIP 2.2.2.2 -TTL 600
Related Commands add ns acl rm ns acl clear ns simpleacl rm ns simpleacl flush ns simpleacl show ns simpleacl stat ns simpleacl
clear ns simpleacl
Synopsis clear ns simpleacl Description Clear all configured SimpleACL rules. Arguments Example Related Commands add ns simpleacl rm ns simpleacl flush ns simpleacl show ns simpleacl stat ns simpleacl
rm ns simpleacl
Synopsis rm ns simpleacl <aclname> ... Description Remove a SimpleACL rule. Arguments aclname Name of the ACL rule to be deleted. Example rm ns simpleacl rule1 Related Commands add ns simpleacl rm ns acl clear ns simpleacl flush ns simpleacl show ns simpleacl
stat ns simpleacl
flush ns simpleacl
Synopsis flush ns simpleacl -estSessions Description Flush all active sessions matching the simple acl rule. Arguments estSessions Example Related Commands add ns simpleacl clear ns simpleacl rm ns simpleacl show ns simpleacl stat ns simpleacl
show ns simpleacl
Synopsis show ns simpleacl [<aclname>] Description Display all the SimpleACL rules. If a rule name is specified, then only that SimpleACL rule is shown. Arguments aclname Name of the ACL rule. summary fullValues format level aclaction Action associated with the ACL rule. srcIP Source IP address. stateflag SACL state flag. destPort Destination Port. protocol TTL Time to expire this ACL rule(in seconds).
hits Number of hits for this ACL rule. count Example show simpleacl rule1 Name: rule1 Action: DENY srcIP = 10.102.1.150 Protocol = TCP DestPort = 110 Hits: 5 TTL: 200(seconds) Related Commands add ns simpleacl clear ns simpleacl rm ns simpleacl flush ns simpleacl stat ns simpleacl
stat ns simpleacl
Synopsis stat ns simpleacl [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display SimpleACL statistics. Arguments Allow SimpleACL hits (SACLAllow) Total packets that matched a SimpleACL with action ALLOW and got consumed by NetScaler. Bridge SimpleACL hits (SACLBdg) Total packets that matched a SimpleACL with action BRIDGE and got bridged by NetScaler. Deny SimpleACL hits (SACLDeny) Packets dropped because they match SimpleACL (Access Control List) with processing mode set to DENY. SimpleACL hits (SACLHits) Packets matching a SimpleACL. SimpleACL misses (SACLMiss) Packets not matching any SimpleACL. SimpleACLs count (SACLsCount) Number of SimpleACLs configured. Example stat simpleacl Related Commands add ns simpleacl clear ns simpleacl rm ns simpleacl flush ns simpleacl
show ns simpleacl stat ns stat ns acl stat ns acl6 stat ns simpleacl6 stat ns pbr stat ns memory stat ns pbr6
add ns simpleacl6
Synopsis add ns simpleacl6 <aclname> <aclaction> -srcIPv6 <ipv6_addr|null> [-destPort <port> -protocol ( TCP | UDP )] [TTL <positive_integer>] Description Add a SimpleACL6 rule to the system configuration, every inbound ipv6 packet is matched against configured SimpleACL rules and specified action is applied. Arguments aclname Alphanumeric name of the ACL rule. aclaction Action associated with the ACL rule. Possible values: DENY srcIPv6 Source ip6 address for the ACL rule. destPort Destination port for the ACL rule. TTL Time to expire this ACL rule(in seconds). Timer granularity is 4 seconds. Minimum value: 4 Maximum value: 2147483647 Example add simpleacl6 rule1 DENY -srcIP6 fe80::2c0:95ff:fec5:d9b8 -destPort 80 -protocol TCP add simpleacl rule2 DENY -srcIP6 3ffe:100:100::1 -TTL 600 Related Commands clear ns simpleacl6 flush ns simpleacl6 rm ns simpleacl6 show ns simpleacl6 stat ns simpleacl6
clear ns simpleacl6
Synopsis clear ns simpleacl6
Description Clear all configured SimpleACL6 rules. Arguments Example clear ns simpleacl6 Related Commands add ns simpleacl6 rm ns simpleacl6 flush ns simpleacl6 show ns simpleacl6 stat ns simpleacl6
flush ns simpleacl6
Synopsis flush ns simpleacl6 -estSessions Description Flush all active sessions matching the simple acl rule. Arguments estSessions Example Related Commands add ns simpleacl6 clear ns simpleacl6 rm ns simpleacl6 show ns simpleacl6 stat ns simpleacl6
rm ns simpleacl6
Synopsis rm ns simpleacl6 <aclname> ... Description Remove a SimpleACL6 rule. Arguments aclname Name of the Simple ACL6 rule to be deleted. Example rm ns simpleacl6 rule1
Related Commands add ns simpleacl6 rm ns acl6 clear ns simpleacl6 flush ns simpleacl6 show ns simpleacl6 stat ns simpleacl6
show ns simpleacl6
Synopsis show ns simpleacl6 [<aclname>] Description Display all the SimpleACL6 rules. If a rule name is specified, then only that SimpleACL6 rule is shown. Arguments aclname Name of the Simple ACL6 rule. summary fullValues format level aclaction Action associated with the SACL6 rule. srcIPv6 Source IP6 address. stateflag SACL6 state flag. destPort Destination Port. protocol TTL Time to expire this ACL rule(in seconds). hits Number of hits for this SACL6 rule. count Example show simpleacl6 rule1 Name: rule1 Action: DENY Hits: 5 srcIP6 = 3ffe:100:100::1 Protocol = TCP DestPort = 110 TTL: 200(seconds) Related Commands add ns simpleacl6
clear ns simpleacl6 flush ns simpleacl6 rm ns simpleacl6 stat ns simpleacl6
stat ns simpleacl6
Synopsis stat ns simpleacl6 [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display SimpleACL6 statistics. Arguments Allow SimpleACL6 hits (SACL6Allow) Total packets that matched a SimpleACL6 with action ALLOW and got consumed by NetScaler. Bridge SimpleACL6 hits (SACL6Bdg) Total packets that matched a SimpleACL6 with action BRIDGE and got bridged by NetScaler. Deny SimpleACL6 hits (SACL6Deny) Packets dropped because they match SimpleACL6 with processing mode set to DENY. SimpleACL6 hits (SACL6Hits) Packets matching a SimpleACL6. SimpleACL6 misses (SACL6Miss) Packets not matching any SimpleACL6. SimpleACLs6 count (SACL6sCount) Number of SimpleACL6s configured. Example stat simpleacl6 Related Commands add ns simpleacl6 clear ns simpleacl6 flush ns simpleacl6 rm ns simpleacl6 show ns simpleacl6 stat ns stat ns acl stat ns acl6 stat ns simpleacl stat ns pbr stat ns memory stat ns pbr6
add ns pbr
Synopsis add ns pbr <name> <action> [-srcIP [<operator>] <srcIPVal>] [-srcPort [<operator>] <srcPortVal>] [-destIP [<operator>] <destIPVal>] [-destPort [<operator>] <destPortVal>] [-nextHop <nextHopVal>] [-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] [-state ( ENABLED | DISABLED )] Description Add a Policy Based Routing(PBR) to the system configuration. Each inbound packet is matched against configured PBRs and routed accordingly. This command adds the PBR to the configuration space. Use the 'apply pbrs' command to commit this operation. Arguments name The name of the PBR action The action associated with the PBR. Possible values: ALLOW, DENY srcIP The source IP address (range). srcPort The source port (range). destIP The destination IP address (range). destPort The destination port (range). nextHop The Next Hop IP address. srcMac The source MAC address. protocol The IP protocol name. Possible values: ICMP, IGMP, TCP, EGP, IGP, ARGUS, UDP, RDP, RSVP, EIGRP, L2TP, ISIS protocolNumber The IP protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan The VLAN number. Minimum value: 1 Maximum value: 4094 interface The physical interface. priority The priority of the PBR. Minimum value: 1 Maximum value: 81920 msr Enable/disable Monitored Static Route(MSR) on this route. Possible values: ENABLED, DISABLED Default value: DISABLED state
The state of the PBR. Possible values: ENABLED, DISABLED Default value: XACLENABLED Example add ns pbr a allow -srcip 10.102.37.252 -destip 10.10.10.2 -nexthop 11.11.11.2 Related Commands clear pbrs apply pbrs rm ns pbr set ns pbr unset ns pbr enable ns pbr disable ns pbr stat ns pbr show ns pbr
rm ns pbr
Synopsis rm ns pbr <name> ... Description Remove a Policy Based Routing(PBR). Use the 'apply pbrs' command to commit this operation. Arguments name The name of the PBR to be deleted. Example rm ns pbr a Related Commands apply pbrs clear pbrs add ns pbr set ns pbr unset ns pbr enable ns pbr disable ns pbr stat ns pbr show ns pbr
set ns pbr
Synopsis set ns pbr <name> [-action ( ALLOW | DENY )] [-srcIP [<operator>] <srcIPVal>] [-srcPort [<operator>] <srcPortVal>] [-destIP [<operator>] <destIPVal>] [-destPort [<operator>] <destPortVal>] [-nextHop <nextHopVal>]
[-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [interface <interface_name>] [-priority <positive_integer>] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] [state ( ENABLED | DISABLED )] Description Modify a Policy Based Routing(PBR). Use the 'apply pbrs' command to commit this operation. Arguments name The name of the PBR. action The action associated with the PBR. Possible values: ALLOW, DENY srcIP The source IP address (range). srcPort The source port (range). destIP The destination IP address (range). destPort The destination port (range). nextHop The Next Hop IP address. srcMac The source MAC address. protocol The IP protocol name. Possible values: ICMP, IGMP, TCP, EGP, IGP, ARGUS, UDP, RDP, RSVP, EIGRP, L2TP, ISIS protocolNumber The IP protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan The VLAN number. Minimum value: 1 Maximum value: 4094 interface The physical interface. priority The priority of the PBR. Minimum value: 1 Maximum value: 81920 msr Enable/disable Monitored Static Route(MSR) on this route. Possible values: ENABLED, DISABLED Default value: DISABLED state The state of the PBR. Possible values: ENABLED, DISABLED Default value: XACLENABLED Example set ns pbr a -srcPort 50 Related Commands clear pbrs
apply pbrs add ns pbr rm ns pbr unset ns pbr enable ns pbr disable ns pbr stat ns pbr show ns pbr
unset ns pbr
Synopsis unset ns pbr <name> [-srcIP] [-srcPort] [-destIP] [-destPort] [-nextHop] [-srcMac] [-protocol] [-vlan] [-interface] [msr] [-monitor] Description Modify a Policy Based Routing(PBR). Use the 'apply pbrs' command to commit this operation..Refer to the set ns pbr command for meanings of the arguments. Arguments Example unset ns pbr rule1 -srcPort Related Commands set ns pbr clear pbrs apply pbrs add ns pbr rm ns pbr enable ns pbr disable ns pbr stat ns pbr show ns pbr
enable ns pbr
Synopsis enable ns pbr <name> ... Description Enable a Policy Based Routing(PBR). Use the 'apply pbrs' command to commit this operation. Arguments name The name of the PBR to be enabled.
Example enable ns pbr foo Related Commands apply pbrs clear pbrs add ns pbr rm ns pbr set ns pbr unset ns pbr disable ns pbr stat ns pbr show ns pbr
disable ns pbr
Synopsis disable ns pbr <name> ... Description Disable a Policy Based Routing(PBR). Use the 'apply pbrs' command to commit this operation. Arguments name The name of the PBR to be disabled. Example disable ns pbr foo Related Commands apply pbrs clear pbrs add ns pbr rm ns pbr set ns pbr unset ns pbr enable ns pbr stat ns pbr show ns pbr
stat ns pbr
Synopsis stat ns pbr [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>]
Description Display Policy Based Routing(PBR) statistics. Arguments name The PBR. count devno stateflag Allow PBR hits (PBRAllow) Total packets that matched the PBR (Policy-Based Routes) with action ALLOW Deny PBR hits (PBRDeny) Total packets that matched the PBR with action DENY PBR hits (PBRTotHits) Total packets that matched one of the configured PBR PBR misses (PBRMiss) Total packets that did not match any PBR Hits for this PBR (PBRHits) Number of times the pbr was hit Example stat pbr Related Commands add ns pbr rm ns pbr set ns pbr unset ns pbr enable ns pbr disable ns pbr show ns pbr stat ns stat ns acl stat ns acl6 stat ns simpleacl stat ns simpleacl6 stat ns memory stat ns pbr6
show ns pbr
Synopsis show ns pbr [<name>] [-detail]
Description Display the Policy Based Routing(PBR).If name is specified, then only that particular PBR information is displayed. If it is not specified, all configured PBRs are displayed. Arguments name The name of the PBR. detail To get a detailed view. summary fullValues format level action The action associated with the PBR. srcMac The source MAC address. protocol The protocol number in IP header or name. protocolNumber The protocol number in IP header or name. srcPortVal The source port (range). destPortVal The destination port (range). srcIPVal The source IP address (range). destIPVal The destination IP address (range). vlan The VLAN number. state The state of the PBR. interface The physical interface. hits The hits of this PBR. priority The priority of the PBR. operator Logical operator. operator Logical operator.
operator Logical operator. operator Logical operator. kernelstate The commit status of the PBR. nextHopVal The Next Hop IP address or gateway name. msr Whether Monitored Static Route(MSR) is enabled or disabled. monitor The name of the monitor. state If this route is UP/DOWN. totalprobes The total number of probes sent. totalfailedprobes The total number of failed probes. failedprobes Number of the current failed monitoring probes. monStatCode The code indicating the monitor response. monStatParam1 First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. data Internal data of this route. count stateflag Example show ns pbr a Name: a Action: ALLOW Hits: 0 srcIP = 10.102.37.252 destIP = 10.10.10.2 srcMac: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 NextHop: 11.11.11.2 Related Commands add ns pbr rm ns pbr set ns pbr unset ns pbr
enable ns pbr disable ns pbr stat ns pbr
add ns xmlnamespace
Synopsis add ns xmlnamespace <prefix> <namespace> Description Add an XML prefix to namespace URI mapping. Arguments prefix The prefix of a namespace. The name must not exceed 31 characters. namespace The expanded namespace. Example add ns xmlnamespace soap http://schemas.xmlsoap.org/soap/envelope/
Related Commands rm ns xmlnamespace set ns xmlnamespace unset ns xmlnamespace show ns xmlnamespace
rm ns xmlnamespace
Synopsis rm ns xmlnamespace <prefix> Description Removes the XML prefix to namespace mapping for the prefix specified Arguments prefix The name of the prefix. Example rm ns xmlnamespace soap
Related Commands add ns xmlnamespace
set ns xmlnamespace unset ns xmlnamespace show ns xmlnamespace
set ns xmlnamespace
Synopsis set ns xmlnamespace <prefix> [<namespace>] [-description <string>] Description Set the namespace or description for an XML prefix to namespace mapping Arguments prefix The name of the prefix. namespace The expanded namespace. description Description for the prefix. Example set ns xmlnamespace soap -description SOAP/1.1
Related Commands add ns xmlnamespace rm ns xmlnamespace unset ns xmlnamespace show ns xmlnamespace
unset ns xmlnamespace
Synopsis unset ns xmlnamespace <prefix> [-namespace] [-description] Description Use this command to remove ns xmlnamespace settings.Refer to the set ns xmlnamespace command for meanings of the arguments. Arguments Example
Related Commands add ns xmlnamespace
rm ns xmlnamespace set ns xmlnamespace show ns xmlnamespace
show ns xmlnamespace
Synopsis show ns xmlnamespace [<prefix>] Description Display the configured XML prefix to namespace URI mapping(s). Arguments prefix The name of the prefix. summary fullValues format level namespace The expanded namespace. description Description for the prefix. count stateflag Example show ns xmlnamespace soap
Related Commands add ns xmlnamespace rm ns xmlnamespace set ns xmlnamespace unset ns xmlnamespace
add ns tcpProfile
Synopsis add ns tcpProfile <name> [-WS ( ENABLED | DISABLED )] [-SACK ( ENABLED | DISABLED )] [WSVal <positive_integer>] [-nagle ( ENABLED | DISABLED )] [-ackOnPush ( ENABLED | DISABLED )] [-mss <positive_integer>] [-maxBurst <positive_integer>] [-initialCwnd <positive_integer>] [-delayedAck <positive_integer>] [-oooQSize <positive_integer>] [-maxPktPerMss <positive_integer>] [-pktPerRetx <positive_integer>] [-minRTO <positive_integer>] [-slowStartIncr <positive_integer>] [-bufferSize
<positive_integer>] [-synCookie ( ENABLED | DISABLED )] [-KAprobeUpdateLastactivity ( ENABLED | DISABLED )] [-flavor ( Default | Westwood )] [-dynamicReceiveBuffering ( ENABLED | DISABLED )] Description Add a new TCP profile on the Netscaler Arguments name Name of the TCP profile WS The state of WS Possible values: ENABLED, DISABLED Default value: DISABLED SACK The state of SACK Possible values: ENABLED, DISABLED Default value: DISABLED WSVal Window Scaling Factor used Default value: 4 Maximum value: 14 nagle Whether to enable Nagle's algorithm on connections Possible values: ENABLED, DISABLED Default value: DISABLED ackOnPush Enable/disable immediate ACK on PUSH packet Possible values: ENABLED, DISABLED Default value: ENABLED mss Set Maximum Segment Size(MSS) to use for TCP Connection (0 forces use of global setting). Maximum value: 1460 maxBurst Max-Burst Factor used Default value: 6 Minimum value: 1 Maximum value: 255 initialCwnd Intial value of TCP cwnd used Default value: 4 Minimum value: 1 Maximum value: 44 delayedAck Delayed acknowledgement timeout (in millisec) Default value: 200 Minimum value: 10 Maximum value: 300 oooQSize Maximum size of out-of-order packet queue (0 means infinite) Default value: 64 Maximum value: 65535 maxPktPerMss Enable packet count based congestion control by setting to non zero value Maximum value: 512 pktPerRetx Set value for maximum number packets per retransmission Default value: 1 Minimum value: 1 Maximum value: 512 minRTO Set minimum limit on TCP RTO (in millisec) Default value: 1000 Minimum value: 10 Maximum value: 64000 slowStartIncr Set TCP slowstart increment factor Default value: 2 Minimum value: 1 Maximum value: 100 bufferSize Set TCP buffer size Default value: 8190 Minimum value: 8190 Maximum value: 4194304
synCookie Whether to enable syncookie on connections Possible values: ENABLED, DISABLED Default value: ENABLED KAprobeUpdateLastactivity Update last activity for KA probes Possible values: ENABLED, DISABLED Default value: ENABLED flavor Set TCP algorithm Possible values: Default, Westwood Default value: NS_TCP_DEFAULT dynamicReceiveBuffering Enable/Disable Dynamic Receive Buffering Possible values: ENABLED, DISABLED Default value: ENABLED Example add tcpprofile <profile name> -WS ENABLED -WSVAL 4 Related Commands rm ns tcpProfile set ns tcpProfile unset ns tcpProfile show ns tcpProfile
rm ns tcpProfile
Synopsis rm ns tcpProfile <name> Description Remove a TCP profile on the Netscaler Arguments name Name of the TCP profile Example rm tcpprofile <profile name> Related Commands add ns tcpProfile set ns tcpProfile unset ns tcpProfile show ns tcpProfile
set ns tcpProfile
Synopsis set ns tcpProfile <name> [-WS ( ENABLED | DISABLED )] [-SACK ( ENABLED | DISABLED )] [-WSVal <positive_integer>] [-nagle ( ENABLED | DISABLED )] [-ackOnPush ( ENABLED | DISABLED )] [-
mss <positive_integer>] [-maxBurst <positive_integer>] [-initialCwnd <positive_integer>] [-delayedAck <positive_integer>] [-oooQSize <integer>] [-maxPktPerMss <positive_integer>] [-pktPerRetx <positive_integer>] [-minRTO <positive_integer>] [-slowStartIncr <positive_integer>] [-bufferSize <positive_integer>] [-synCookie ( ENABLED | DISABLED )] [-KAprobeUpdateLastactivity ( ENABLED | DISABLED )] [-flavor ( Default | Westwood )] [-dynamicReceiveBuffering ( ENABLED | DISABLED )] Description Set/modify TCP profile values Arguments name Name of the TCP profile WS The state of WS Possible values: ENABLED, DISABLED Default value: DISABLED SACK The state of SACK Possible values: ENABLED, DISABLED Default value: DISABLED WSVal Window Scaling Factor used Default value: 4 Maximum value: 14 nagle Whether to enable Nagle's algorithm on connections Possible values: ENABLED, DISABLED Default value: DISABLED ackOnPush Enable/disable immediate ACK on PUSH packet Possible values: ENABLED, DISABLED Default value: ENABLED mss Set Maximum Segment Size(MSS) to use for TCP Connection(0 forces use of global setting) Maximum value: 1460 maxBurst Max-Burst Factor used Default value: 6 Minimum value: 1 Maximum value: 255 initialCwnd Intial value of TCP cwnd used Default value: 4 Minimum value: 1 Maximum value: 44 delayedAck Delayed acknowledgement timeout (in millisec) Default value: 200 Minimum value: 10 Maximum value: 300 oooQSize Maximum size of out-of-order packet queue (0 means infinite) Default value: 64 Maximum value: 65535 maxPktPerMss Enable packet count based congestion control by setting to non zero value Maximum value: 512 pktPerRetx Set value for maximum number packets per retransmission Default value: 1 Minimum value: 1 Maximum value: 512 minRTO Set minimum limit on TCP RTO (in millisec) Default value: 1000 Minimum value: 10 Maximum value: 64000 slowStartIncr Set TCP slowstart increment factor Default value: 2 Minimum value: 1 Maximum value: 100
bufferSize Set TCP buffer size Default value: 8190 Minimum value: 8190 Maximum value: 4194304 synCookie Whether to enable syncookie on connections Possible values: ENABLED, DISABLED Default value: ENABLED KAprobeUpdateLastactivity Update last activity for KA probes Possible values: ENABLED, DISABLED Default value: ENABLED flavor Set TCP algorithm Possible values: Default, Westwood Default value: NS_TCP_DEFAULT dynamicReceiveBuffering Enable/Disable Dynamic Receive Buffering Possible values: ENABLED, DISABLED Default value: ENABLED Example set tcpprofile <profile name> -WS ENABLED -WSVAL 4 Related Commands add ns tcpProfile rm ns tcpProfile unset ns tcpProfile show ns tcpProfile
unset ns tcpProfile
Synopsis unset ns tcpProfile <name> [-WS] [-SACK] [-WSVal] [-nagle] [-ackOnPush] [-maxBurst] [-initialCwnd] [delayedAck] [-oooQSize] [-maxPktPerMss] [-pktPerRetx] [-minRTO] [-slowStartIncr] [-bufferSize] [-synCookie] [KAprobeUpdateLastactivity] [-mss] [-flavor] [-dynamicReceiveBuffering] Description Unset a TCP profile values.Refer to the set ns tcpProfile command for meanings of the arguments. Arguments Example Related Commands add ns tcpProfile rm ns tcpProfile set ns tcpProfile show ns tcpProfile
show ns tcpProfile
Synopsis show ns tcpProfile [<name>]
Description Display all the configured TCP profiles in the system. If a name is specified, then only that profile is shown. Arguments name Name of the TCP profile. summary fullValues format level WS The state of WS SACK The state of SACK WSVal Window Scaling Factor used nagle Whether to enable Nagle's algorithm on connections ackOnPush Enable/disable immediate ACK on PUSH packet mss Maximum Segment Size(MSS) to use for TCP Connection(0 forces use of global setting) maxBurst Max-Burst Factor used initialCwnd Intial value of TCP cwnd used delayedAck Delayed acknowledgement timeout (in millisec) oooQSize Maximum size of out-of-order packet queue (0 means infinite) maxPktPerMss Maximum packet per MSS value pktPerRetx Set value for maximum number packets per retransmission minRTO TCP minimum RTO (in millisec) slowStartIncr TCP slowstart increment factor bufferSize TCP Buffer size flavor TCP algorithm refCnt
Number of entities using this profile synCookie Whether to enable syncookie on connections KAprobeUpdateLastactivity Update last activity for KA probes dynamicReceiveBuffering Enable/Disable Dynamic Receive Buffering stateflag State flag count Example show tcp profile [profile name] Related Commands add ns tcpProfile rm ns tcpProfile set ns tcpProfile unset ns tcpProfile
add ns httpProfile
Synopsis add ns httpProfile <name> [-dropInvalReqs ( ENABLED | DISABLED )] [-markHttp09Inval ( ENABLED | DISABLED )] [-markConnReqInval ( ENABLED | DISABLED )] [-cmpOnPush ( ENABLED | DISABLED )] [conMultiplex ( ENABLED | DISABLED )] [-maxReusePool <positive_integer>] [-dropExtraCRLF ( ENABLED | DISABLED )] [-incompHdrDelay <positive_integer>] [-webSocket ( ENABLED | DISABLED )] [-reqTimeout <positive_integer>] [-adptTimeout ( ENABLED | DISABLED )] [-reqTimeoutAction <string>] [-dropExtraData ( ENABLED | DISABLED )] [-webLog ( ENABLED | DISABLED )] [-clientIpHdrExpr <expression>] [-maxReq <positive_integer>] [-persistentETag ( ENABLED | DISABLED )] Description Add a new HTTP profile on the Netscaler Arguments name Name of the HTTP profile dropInvalReqs Enable/disable dropping of invalid HTTP requests/responses Possible values: ENABLED, DISABLED Default value: DISABLED markHttp09Inval Enable/disable invalidating HTTP 0.9 requests Possible values: ENABLED, DISABLED Default value: DISABLED markConnReqInval Enable/disable invalidating CONNECT HTTP requests Possible values: ENABLED, DISABLED Default value: DISABLED cmpOnPush
Enable/disable compression on PUSH packet Possible values: ENABLED, DISABLED Default value: DISABLED conMultiplex Connection multiplexing Possible values: ENABLED, DISABLED Default value: ENABLED maxReusePool Maximum connections in reusepool. If set to zero, limit will not be applied Maximum value: 360000 dropExtraCRLF Drop extra CRLF after header is complete Possible values: ENABLED, DISABLED Default value: ENABLED incompHdrDelay Maximum time to wait between incomplete header packets (ms ticks) Default value: 7000 webSocket Enable or disable WebSocket connections. Possible values: ENABLED, DISABLED Default value: DISABLED reqTimeout The time (in seconds) within which the HTTP request must complete. adptTimeout The configured request timeout changed to adapt to the flow conditions. Possible values: ENABLED, DISABLED Default value: DISABLED reqTimeoutAction The responder action to respond to the client when timeout occurs. It can be either of RESET| DROP|Custom Responder Action. Connection is dropped silently if no action is set. RESET: Send RST to client when timeout occurs. DROP: Drop the connection when timeout occurs. Responder Action: Name of the responder action to trigger when timeout occurs, used to send custom message. dropExtraData Enable or disable dropping extra data from server. Possible values: ENABLED, DISABLED Default value: DISABLED webLog Enable or disable weblogging Possible values: ENABLED, DISABLED Default value: ENABLED clientIpHdrExpr Name of the header that contains real client IP. maxReq Maximum requests allowed on a single connection persistentETag Generate the persistent NetScaler specific ETag for the HTTP response with ETag header. Possible values: ENABLED, DISABLED Default value: DISABLED Example add httpprofile <profile name> -dropInvalReqs ON -markHttp09Inval ON
Related Commands rm ns httpProfile set ns httpProfile unset ns httpProfile
show ns httpProfile
rm ns httpProfile
Synopsis rm ns httpProfile <name> Description Remove a HTTP profile on the Netscaler Arguments name Name of the TCP profile Example rm httpprofile <profile name> Related Commands add ns httpProfile set ns httpProfile unset ns httpProfile show ns httpProfile
set ns httpProfile
Synopsis set ns httpProfile <name> [-dropInvalReqs ( ENABLED | DISABLED )] [-markHttp09Inval ( ENABLED | DISABLED )] [-markConnReqInval ( ENABLED | DISABLED )] [-cmpOnPush ( ENABLED | DISABLED )] [conMultiplex ( ENABLED | DISABLED )] [-maxReusePool <positive_integer>] [-dropExtraCRLF ( ENABLED | DISABLED )] [-incompHdrDelay <positive_integer>] [-webSocket ( ENABLED | DISABLED )] [-reqTimeout <positive_integer>] [-adptTimeout ( ENABLED | DISABLED )] [-reqTimeoutAction <string>] [-dropExtraData ( ENABLED | DISABLED )] [-webLog ( ENABLED | DISABLED )] [-clientIpHdrExpr <expression>] [-maxReq <positive_integer>] [-persistentETag ( ENABLED | DISABLED )] Description Set/modify HTTP profile values Arguments name Name of the HTTP profile dropInvalReqs Enable/disable dropping of invalid HTTP requests/responses Possible values: ENABLED, DISABLED Default value: DISABLED markHttp09Inval Enable/disable invalidating HTTP 0.9 requests Possible values: ENABLED, DISABLED Default value: DISABLED markConnReqInval Enable/disable invalidating CONNECT HTTP requests Possible values: ENABLED, DISABLED Default value: DISABLED
cmpOnPush Enable/disable compression on PUSH packet Possible values: ENABLED, DISABLED Default value: DISABLED conMultiplex Connection multiplexing Possible values: ENABLED, DISABLED Default value: ENABLED maxReusePool Maximum connections in reusepool. If set to zero, limit will not be applied. Maximum value: 360000 dropExtraCRLF Drop extra CRLF after header is complete Possible values: ENABLED, DISABLED Default value: ENABLED incompHdrDelay Maximum time to wait between incomplete header packets (ms ticks) Default value: 7000 webSocket Enable or disable WebSocket connections. Possible values: ENABLED, DISABLED Default value: DISABLED reqTimeout The time (in seconds) within which the HTTP request must complete. adptTimeout The configured request timeout changed to adapt to the flow conditions. Possible values: ENABLED, DISABLED Default value: DISABLED reqTimeoutAction The responder action to respond to the client when timeout occurs. It can be either of RESET| DROP|Custom Responder Action. Connection is dropped silently if no action is set. RESET: Send RST to client when timeout occurs. DROP: Drop the connection when timeout occurs. Responder Action: Name of the responder action to trigger when timeout occurs, used to send custom message. dropExtraData Enable or disable dropping extra data from server. Possible values: ENABLED, DISABLED Default value: DISABLED webLog Enable or disable weblogging Possible values: ENABLED, DISABLED Default value: ENABLED clientIpHdrExpr Name of the header that contains real client IP. maxReq Maximum requests allowed on a single connection persistentETag Generate the persistent NetScaler specific ETag for the HTTP response with ETag header. Possible values: ENABLED, DISABLED Default value: DISABLED Example set httpprofile <profile name> -dropInvalReqs ON -markHttp09Inval ON
Related Commands add ns httpProfile rm ns httpProfile
unset ns httpProfile show ns httpProfile
unset ns httpProfile
Synopsis unset ns httpProfile <name> [-dropInvalReqs] [-markHttp09Inval] [-markConnReqInval] [-cmpOnPush] [conMultiplex] [-maxReusePool] [-dropExtraCRLF] [-incompHdrDelay] [-webSocket] [-reqTimeout] [-adptTimeout] [-reqTimeoutAction] [-dropExtraData] [-webLog] [-clientIpHdrExpr] [-maxReq] [-persistentETag] Description Unset HTTP profile values.Refer to the set ns httpProfile command for meanings of the arguments. Arguments Example
Related Commands add ns httpProfile rm ns httpProfile set ns httpProfile show ns httpProfile
show ns httpProfile
Synopsis show ns httpProfile [<name>] Description Display all the configured HTTP profiles in the system. If a name is specified, then only that profile is shown. Arguments name Name of the HTTP profile. summary fullValues format level dropInvalReqs Dropping of invalid HTTP requests/responses markHttp09Inval Invalidating HTTP 0.9 requests markConnReqInval Invalidating CONNECT HTTP requests
cmpOnPush Compression on PUSH packet conMultiplex Connection multiplexing maxReusePool Maximum connections in reusepool webSocket Enable or disable WebSocket connections. refCnt Number of entities using this profile stateflag State flag dropExtraCRLF Drop extra CRLF after header is complete incompHdrDelay Maximum time to wait between incomplete header packets (ms ticks) reqTimeout The time (in seconds) within which the HTTP request must complete. adptTimeout The configured request timeout changed to adapt to the flow conditions. reqTimeoutAction The responder action to respond to the client when timeout occurs. It can be either of RESET| DROP|Custom Responder Action. Connection is dropped silently if no action is set. RESET: Send RST to client when timeout occurs. DROP: Drop the connection when timeout occurs. Responder Action: Name of the responder action to trigger when timeout occurs, used to send custom message. dropExtraData Enable or disable dropping extra data from server. webLog Disabling weblog option clientIpHdrExpr Name of the header that contains real client IP. maxReq Maximum requests allowed on a single connection persistentETag Generate the persistent NetScaler specific ETag for the HTTP response with ETag header. count Example show http profile [profile name]
Related Commands add ns httpProfile rm ns httpProfile
set ns httpProfile unset ns httpProfile
add ns appflowCollector
Synopsis
Description Add a new AppFlow collector. NOTE: This command is deprecated.This command is deprecated in favor of 'add appflow collector' Arguments name Name of the AppFlow collector. IPAddress The IPv4 address of the AppFlow collector. port The UDP port on which the AppFlow collector is listening. Default value: 4739 Example add ns appflowCollector collector1 -IPAddress 192.168.1.40 -port 2055
Related Commands rm ns appflowCollector show ns appflowCollector
rm ns appflowCollector
Synopsis
Description Remove an AppFlow collector. NOTE: This command is deprecated.This command is deprecated in favor of 'rm appflow collector' Arguments name Name of an AppFlow collector. Example rm ns appflowCollector collector1
Related Commands add ns appflowCollector show ns appflowCollector
show ns appflowCollector
Synopsis
Description Display details of all the AppFlow collectors configured on the system. Alternatively, to view the details of a particular AppFlow collector, specify its name. NOTE: This command is deprecated.This command is deprecated in favor of 'show appflow collector' Arguments name Name of the AppFlow collector. summary fullValues format level IPAddress The IPv4 address of the AppFlow collector. port The UDP port on which the AppFlow collector is listening. count stateflag Example show ns appflowCollector collector1
Related Commands add ns appflowCollector rm ns appflowCollector
show ns stats
Synopsis show ns stats - alias for 'stat ns' Description show ns stats is an alias for stat ns Arguments Example
Related Commands stat ns
show ns ns.conf
Synopsis show ns ns.conf Description Display the last saved configuration. Arguments textBlob Text of the last saved configuration. Example
Related Commands
show ns savedConfig
Synopsis show ns savedConfig Description Display the last saved configuration. Arguments textBlob Text of the last saved configuration. Example
Related Commands
show ns runningConfig
Synopsis show ns runningConfig [-withDefaults] Description Display the information pertaining to all the configuration that has been applied to the system, including settings that have not yet been saved to the system's ns.conf file using the save config command. Arguments withDefaults response running config data as text blob
Example
Related Commands
renumber ns acls
Synopsis renumber ns acls Description Reorganize ACL priorities. This will introduce gaps between ACL priorities. This command does not affect the behaviour of ACLs. Arguments Example renumber acls Related Commands apply ns acls clear ns acls
clear ns acls
Synopsis clear ns acls Description Clear all configured ACLs. This operation does not require an explicit apply. Arguments Example clear ns acls Related Commands add ns acl rm ns acl renumber ns acls apply ns acls
apply ns acls
Synopsis apply ns acls
Description Commit the ACL in the configuration space to the system. This is required after you add ACLs or modify the ACLs. Arguments Example apply ns acls
Related Commands add ns acl rm ns acl set ns acl enable ns acl disable ns acl renumber ns acls clear ns acls
show ns info
Synopsis show ns info Description Display the most relevant information about a system, including: l Software version l Features that are enabled and disabled l Modes that are enabled and disabled l Whether the system is acting as a normal or master node l The system IP address and mapped IP. Arguments Example An example of this command's output is shown below: System Rainier: Build 24, Date: Apr 25 2002, 21:13:25 System IP: 10.101.4.22 (mask: 255.255.0.0) Mapped IP: 10.101.4.23 Node: Standalone HTTP port(s): (none) Max connections: 0 Max requests per connection: 0 Client IP insertion enabled: NO Cookie version: 0 Feature status: Web Logging: ON Surge Protection: ON Load Balancing: ON Content Switching: ON Cache Redirection: ON Sure Connect: ON Compression Control: OFF Priority Queuing: ON SSL Offloading: ON Global Server Load Balancing: ON HTTP DoS Protection: OFF N+1: OFF Dynamic Routing: OFF Content Filtering: ON Internal Caching: ON SSL VPN: OFF Mode status: Fast Ramp: ON Layer 2 mode: ON Use Source IP: OFF Client Keep-alive: ON TCP Buffering: OFF MAC-based forwarding: ON Edge configuration: OFF Use Subnet IP: OFF Layer 3 mode (ip forwarding): ON
Related Commands
show ns license
Synopsis show ns license
Description Display information about the current system license. Arguments WL Web Logging. SP Surge Protection. LB Load Balancing. CS Content Switching. CR Cache Redirect. SC Sure Connect. CMP Compression. DELTA Delta Compression. PQ Priority Queuing. SSL Secure Sockets Layer. GSLB Global Server Load Balancing. GSLBP GSLB Proximity. HDOSP DOS Protection. Routing Routing. CF Content Filter. IC Integrated Caching. SSLVPN SSL VPN. AAA AAA OSPF OSPF Routing. RIP RIP Routing.
BGP BGP Routing. REWRITE Rewrite. IPv6PT IPv6 protocol translation AppFw Application Firewall. RESPONDER Responder. AGEE NSXN HTMLInjection HTML Injection. ModelID Model Number ID. push NetScaler Push. WIonNS WI on NS. AppFlow AppFlow. CloudBridge CloudBridge. CloudBridgeAppliance CloudExtenderAppliance ISIS ISIS Routing. Cluster Clustering CH Call Home. Example Related Commands
show ns version
Synopsis show ns version Description Display the version and build number of the system.
Arguments version Version. Mode Kernel mode (KMPE/VMPE). Example Related Commands
clear ns config
Synopsis clear ns config [-force] <level> Description Clear NS Config. Arguments force Specifies whether the configurations must be cleared without prompting for confirmation. level The types of configurations to be cleared. Possible values basic: Clears all configurations except the following: NSIP, default route (gateway), MIPs, and SNIPs Network settings (DG, VLAN, RHI, NTP and DNS settings) Cluster settings HA node definitions Feature and mode settings nsroot password extended: Clears the same configurations as the .basic. option. In addition, it clears the nsroot password and feature and mode settings. full: Clears all configurations except NSIP, default route, and interface settings. Possible values: basic, extended, full Example Related Commands set ns config unset ns config save ns config show ns config diff ns config
set ns config
Synopsis set ns config [-IPAddress <ip_addr> -netmask <netmask>] [-nsvlan <positive_integer> -ifnum <interface_name> ... [-tagged ( YES | NO )]] Description Set the system parameters. Use "set nsparam" command to set other netscaler parameters. Arguments IPAddress The IP address of the system. nsvlan
The VLAN (NSVLAN) for the subnet on which the IP resides. Minimum value: 2 Maximum value: 4094 httpPort The HTTP ports on the Web server. This allows the system to perform connection off-load for any client request that has a destination port matching one of these configured ports. Minimum value: 1 maxConn The maximum number of connections that will be made from the system to the web server(s) attached to it. The value entered here is applied globally to all attached servers. Maximum value: 4294967294 maxReq The maximum number of requests that the system can pass on a particular connection between the system and a server attached to it. Setting this value to 0 allows an unlimited number of requests to be passed. Maximum value: 65535 cip The option to control (enable or disable) the insertion of the actual client IP address into the HTTP header request passed from the client to one, some, or all servers attached to the system. The passed address can then be accessed through a minor modification to the server. l If cipHeader is specified, it will be used as the client IP header. l If it is not specified, then the value that has been set by the set ns config CLI command will be used as the client IP header. Possible values: ENABLED, DISABLED cookieversion The version of the cookie inserted by system. Possible values: 0, 1 secureCookie enable/disable secure flag for persistence cookie Possible values: ENABLED, DISABLED Default value: ENABLED pmtuMin The minimum Path MTU. Default value: 576 Minimum value: 168 Maximum value: 1500 pmtuTimeout The timeout value in minutes. Default value: 10 Minimum value: 1 Maximum value: 1440 ftpPortRange Port range configured for FTP services. Minimum value: 1024 Maximum value: 64000 crPortRange Port range for cache redirection services. Minimum value: 1 Maximum value: 65535 timezone Name of the timezone Possible values: GMT+01:00-CET-Europe/Andorra, GMT+04:00-GSTAsia/Dubai, GMT+04:30-AFT-Asia/Kabul, GMT-04:00-AST-America/Antigua, GMT-04:00AST-America/Anguilla, GMT+01:00-CET-Europe/Tirane, GMT+04:00-AMT-Asia/Yerevan, GMT+01:00-WAT-Africa/Luanda, GMT+13:00-NZDT-Antarctica/McMurdo, GMT+13:00NZDT-Antarctica/South_Pole, GMT-03:00-ROTT-Antarctica/Rothera, GMT-04:00-CLTAntarctica/Palmer, GMT+05:00-MAWT-Antarctica/Mawson, GMT+07:00-DAVT-Antarctica/ Davis, GMT+08:00-WST-Antarctica/Casey, GMT+06:00-VOST-Antarctica/Vostok, GMT+10:00DDUT-Antarctica/DumontDUrville, GMT+03:00-SYOT-Antarctica/Syowa, GMT+11:00-MISTAntarctica/Macquarie, GMT-03:00-ART-America/Argentina/Buenos_Aires, GMT-03:00-ARTAmerica/Argentina/Cordoba, GMT-03:00-ART-America/Argentina/Salta, GMT-03:00-ARTAmerica/Argentina/Jujuy, GMT-03:00-ART-America/Argentina/Tucuman, GMT-03:00-ARTAmerica/Argentina/Catamarca, GMT-03:00-ART-America/Argentina/La_Rioja, GMT-03:00ART-America/Argentina/San_Juan, GMT-03:00-ART-America/Argentina/Mendoza, GMT-03:00WARST-America/Argentina/San_Luis, GMT-03:00-ART-America/Argentina/Rio_Gallegos, GMT-03:00-ART-America/Argentina/Ushuaia, GMT-11:00-SST-Pacific/Pago_Pago, GMT
+01:00-CET-Europe/Vienna, GMT+11:00-LHST-Australia/Lord_Howe, GMT+11:00-ESTAustralia/Hobart, GMT+11:00-EST-Australia/Currie, GMT+11:00-EST-Australia/Melbourne, GMT+11:00-EST-Australia/Sydney, GMT+10:30-CST-Australia/Broken_Hill, GMT+10:00EST-Australia/Brisbane, GMT+10:00-EST-Australia/Lindeman, GMT+10:30-CST-Australia/ Adelaide, GMT+09:30-CST-Australia/Darwin, GMT+08:00-WST-Australia/Perth, GMT+08:45CWST-Australia/Eucla, GMT-04:00-AST-America/Aruba, GMT+02:00-EET-Europe/Mariehamn, GMT+04:00-AZT-Asia/Baku, GMT+01:00-CET-Europe/Sarajevo, GMT-04:00-AST-America/ Barbados, GMT+06:00-BDT-Asia/Dhaka, GMT+01:00-CET-Europe/Brussels, GMT+00:00GMT-Africa/Ouagadougou, GMT+02:00-EET-Europe/Sofia, GMT+03:00-AST-Asia/Bahrain, GMT+02:00-CAT-Africa/Bujumbura, GMT+01:00-WAT-Africa/Porto-Novo, GMT-04:00AST-America/St_Barthelemy, GMT-03:00-ADT-Atlantic/Bermuda, GMT+08:00-BNT-Asia/ Brunei, GMT-04:00-BOT-America/La_Paz, GMT-02:00-FNT-America/Noronha, GMT-03:00BRT-America/Belem, GMT-03:00-BRT-America/Fortaleza, GMT-03:00-BRT-America/ Recife, GMT-03:00-BRT-America/Araguaina, GMT-03:00-BRT-America/Maceio, GMT-03:00BRT-America/Bahia, GMT-03:00-BRT-America/Sao_Paulo, GMT-04:00-AMT-America/ Campo_Grande, GMT-04:00-AMT-America/Cuiaba, GMT-03:00-BRT-America/Santarem, GMT-04:00-AMT-America/Porto_Velho, GMT-04:00-AMT-America/Boa_Vista, GMT-04:00AMT-America/Manaus, GMT-04:00-AMT-America/Eirunepe, GMT-04:00-AMT-America/ Rio_Branco, GMT-04:00-EDT-America/Nassau, GMT+06:00-BTT-Asia/Thimphu, GMT+02:00CAT-Africa/Gaborone, GMT+03:00-FET-Europe/Minsk, GMT-06:00-CST-America/Belize, GMT-02:30-NDT-America/St_Johns, GMT-03:00-ADT-America/Halifax, GMT-03:00-ADTAmerica/Glace_Bay, GMT-03:00-ADT-America/Moncton, GMT-03:00-ADT-America/Goose_Bay, GMT-04:00-AST-America/Blanc-Sablon, GMT-04:00-EDT-America/Montreal, GMT-04:00-EDTAmerica/Toronto, GMT-04:00-EDT-America/Nipigon, GMT-04:00-EDT-America/Thunder_Bay, GMT-04:00-EDT-America/Iqaluit, GMT-04:00-EDT-America/Pangnirtung, GMT-05:00-CDTAmerica/Resolute, GMT-05:00-EST-America/Atikokan, GMT-05:00-CDT-America/Rankin_Inlet, GMT-05:00-CDT-America/Winnipeg, GMT-05:00-CDT-America/Rainy_River, GMT-06:00CST-America/Regina, GMT-06:00-CST-America/Swift_Current, GMT-06:00-MDT-America/ Edmonton, GMT-06:00-MDT-America/Cambridge_Bay, GMT-06:00-MDT-America/Yellowknife, GMT-06:00-MDT-America/Inuvik, GMT-07:00-MST-America/Dawson_Creek, GMT-07:00PDT-America/Vancouver, GMT-07:00-PDT-America/Whitehorse, GMT-07:00-PDT-America/ Dawson, GMT+06:30-CCT-Indian/Cocos, GMT+01:00-WAT-Africa/Kinshasa, GMT+02:00-CATAfrica/Lubumbashi, GMT+01:00-WAT-Africa/Bangui, GMT+01:00-WAT-Africa/Brazzaville, GMT+01:00-CET-Europe/Zurich, GMT+00:00-GMT-Africa/Abidjan, GMT-10:00-CKT-Pacific/ Rarotonga, GMT-04:00-CLT-America/Santiago, GMT-06:00-EAST-Pacific/Easter, GMT+01:00WAT-Africa/Douala, GMT+08:00-CST-Asia/Shanghai, GMT+08:00-CST-Asia/Harbin, GMT +08:00-CST-Asia/Chongqing, GMT+08:00-CST-Asia/Urumqi, GMT+08:00-CST-Asia/Kashgar, GMT-05:00-COT-America/Bogota, GMT-06:00-CST-America/Costa_Rica, GMT-04:00-CDTAmerica/Havana, GMT-01:00-CVT-Atlantic/Cape_Verde, GMT+07:00-CXT-Indian/Christmas, GMT+02:00-EET-Asia/Nicosia, GMT+01:00-CET-Europe/Prague, GMT+01:00-CET-Europe/ Berlin, GMT+03:00-EAT-Africa/Djibouti, GMT+01:00-CET-Europe/Copenhagen, GMT-04:00AST-America/Dominica, GMT-04:00-AST-America/Santo_Domingo, GMT+01:00-CET-Africa/ Algiers, GMT-05:00-ECT-America/Guayaquil, GMT-06:00-GALT-Pacific/Galapagos, GMT +02:00-EET-Europe/Tallinn, GMT+02:00-EET-Africa/Cairo, GMT+00:00-WET-Africa/El_Aaiun, GMT+03:00-EAT-Africa/Asmara, GMT+01:00-CET-Europe/Madrid, GMT+01:00-CET-Africa/ Ceuta, GMT+00:00-WET-Atlantic/Canary, GMT+03:00-EAT-Africa/Addis_Ababa, GMT+02:00EET-Europe/Helsinki, GMT+12:00-FJT-Pacific/Fiji, GMT-03:00-FKST-Atlantic/Stanley, GMT +10:00-CHUT-Pacific/Chuuk, GMT+11:00-PONT-Pacific/Pohnpei, GMT+11:00-KOST-Pacific/ Kosrae, GMT+00:00-WET-Atlantic/Faroe, GMT+01:00-CET-Europe/Paris, GMT+01:00-WATAfrica/Libreville, GMT+00:00-GMT-Europe/London, GMT-04:00-AST-America/Grenada, GMT +04:00-GET-Asia/Tbilisi, GMT-03:00-GFT-America/Cayenne, GMT+00:00-GMT-Europe/ Guernsey, GMT+00:00-GMT-Africa/Accra, GMT+01:00-CET-Europe/Gibraltar, GMT-03:00WGT-America/Godthab, GMT+00:00-GMT-America/Danmarkshavn, GMT-01:00-EGT-America/ Scoresbysund, GMT-03:00-ADT-America/Thule, GMT+00:00-GMT-Africa/Banjul, GMT+00:00GMT-Africa/Conakry, GMT-04:00-AST-America/Guadeloupe, GMT+01:00-WAT-Africa/Malabo, GMT+02:00-EET-Europe/Athens, GMT-02:00-GST-Atlantic/South_Georgia, GMT-06:00-
CST-America/Guatemala, GMT+10:00-ChST-Pacific/Guam, GMT+00:00-GMT-Africa/Bissau, GMT-04:00-GYT-America/Guyana, GMT+08:00-HKT-Asia/Hong_Kong, GMT-06:00-CSTAmerica/Tegucigalpa, GMT+01:00-CET-Europe/Zagreb, GMT-05:00-EST-America/Port-auPrince, GMT+01:00-CET-Europe/Budapest, GMT+07:00-WIT-Asia/Jakarta, GMT+07:00WIT-Asia/Pontianak, GMT+08:00-CIT-Asia/Makassar, GMT+09:00-EIT-Asia/Jayapura, GMT +00:00-GMT-Europe/Dublin, GMT+02:00-IST-Asia/Jerusalem, GMT+00:00-GMT-Europe/ Isle_of_Man, GMT+05:30-IST-Asia/Kolkata, GMT+06:00-IOT-Indian/Chagos, GMT+03:00AST-Asia/Baghdad, GMT+03:30-IRST-Asia/Tehran, GMT+00:00-GMT-Atlantic/Reykjavik, GMT+01:00-CET-Europe/Rome, GMT+00:00-GMT-Europe/Jersey, GMT-05:00-EST-America/ Jamaica, GMT+02:00-EET-Asia/Amman, GMT+09:00-JST-Asia/Tokyo, GMT+03:00-EATAfrica/Nairobi, GMT+06:00-KGT-Asia/Bishkek, GMT+07:00-ICT-Asia/Phnom_Penh, GMT +12:00-GILT-Pacific/Tarawa, GMT+13:00-PHOT-Pacific/Enderbury, GMT+14:00-LINTPacific/Kiritimati, GMT+03:00-EAT-Indian/Comoro, GMT-04:00-AST-America/St_Kitts, GMT +09:00-KST-Asia/Pyongyang, GMT+09:00-KST-Asia/Seoul, GMT+03:00-AST-Asia/Kuwait, GMT-05:00-EST-America/Cayman, GMT+06:00-ALMT-Asia/Almaty, GMT+06:00-QYZT-Asia/ Qyzylorda, GMT+05:00-AQTT-Asia/Aqtobe, GMT+05:00-AQTT-Asia/Aqtau, GMT+05:00ORAT-Asia/Oral, GMT+07:00-ICT-Asia/Vientiane, GMT+02:00-EET-Asia/Beirut, GMT-04:00AST-America/St_Lucia, GMT+01:00-CET-Europe/Vaduz, GMT+05:30-IST-Asia/Colombo, GMT +00:00-GMT-Africa/Monrovia, GMT+02:00-SAST-Africa/Maseru, GMT+02:00-EET-Europe/ Vilnius, GMT+01:00-CET-Europe/Luxembourg, GMT+02:00-EET-Europe/Riga, GMT+02:00EET-Africa/Tripoli, GMT+00:00-WET-Africa/Casablanca, GMT+01:00-CET-Europe/Monaco, GMT+02:00-EET-Europe/Chisinau, GMT+01:00-CET-Europe/Podgorica, GMT-04:00-ASTAmerica/Marigot, GMT+03:00-EAT-Indian/Antananarivo, GMT+12:00-MHT-Pacific/Majuro, GMT+12:00-MHT-Pacific/Kwajalein, GMT+01:00-CET-Europe/Skopje, GMT+00:00-GMTAfrica/Bamako, GMT+06:30-MMT-Asia/Rangoon, GMT+08:00-ULAT-Asia/Ulaanbaatar, GMT +07:00-HOVT-Asia/Hovd, GMT+08:00-CHOT-Asia/Choibalsan, GMT+08:00-CST-Asia/Macau, GMT+10:00-ChST-Pacific/Saipan, GMT-04:00-AST-America/Martinique, GMT+00:00-GMTAfrica/Nouakchott, GMT-04:00-AST-America/Montserrat, GMT+01:00-CET-Europe/Malta, GMT+04:00-MUT-Indian/Mauritius, GMT+05:00-MVT-Indian/Maldives, GMT+02:00-CATAfrica/Blantyre, GMT-06:00-CST-America/Mexico_City, GMT-06:00-CST-America/Cancun, GMT-06:00-CST-America/Merida, GMT-06:00-CST-America/Monterrey, GMT-05:00-CDTAmerica/Matamoros, GMT-07:00-MST-America/Mazatlan, GMT-07:00-MST-America/Chihuahua, GMT-06:00-MDT-America/Ojinaga, GMT-07:00-MST-America/Hermosillo, GMT-07:00PDT-America/Tijuana, GMT-08:00-PST-America/Santa_Isabel, GMT-06:00-CST-America/ Bahia_Banderas, GMT+08:00-MYT-Asia/Kuala_Lumpur, GMT+08:00-MYT-Asia/Kuching, GMT+02:00-CAT-Africa/Maputo, GMT+02:00-WAST-Africa/Windhoek, GMT+11:00-NCTPacific/Noumea, GMT+01:00-WAT-Africa/Niamey, GMT+11:30-NFT-Pacific/Norfolk, GMT +01:00-WAT-Africa/Lagos, GMT-06:00-CST-America/Managua, GMT+01:00-CET-Europe/ Amsterdam, GMT+01:00-CET-Europe/Oslo, GMT+05:45-NPT-Asia/Kathmandu, GMT+12:00NRT-Pacific/Nauru, GMT-11:00-NUT-Pacific/Niue, GMT+13:00-NZDT-Pacific/Auckland, GMT +13:45-CHADT-Pacific/Chatham, GMT+04:00-GST-Asia/Muscat, GMT-05:00-EST-America/ Panama, GMT-05:00-PET-America/Lima, GMT-10:00-TAHT-Pacific/Tahiti, GMT-09:30-MARTPacific/Marquesas, GMT-09:00-GAMT-Pacific/Gambier, GMT+10:00-PGT-Pacific/Port_Moresby, GMT+08:00-PHT-Asia/Manila, GMT+05:00-PKT-Asia/Karachi, GMT+01:00-CET-Europe/ Warsaw, GMT-02:00-PMDT-America/Miquelon, GMT-08:00-PST-Pacific/Pitcairn, GMT-04:00AST-America/Puerto_Rico, GMT+02:00-EET-Asia/Gaza, GMT+02:00-EET-Asia/Hebron, GMT +00:00-WET-Europe/Lisbon, GMT+00:00-WET-Atlantic/Madeira, GMT-01:00-AZOT-Atlantic/ Azores, GMT+09:00-PWT-Pacific/Palau, GMT-03:00-PYST-America/Asuncion, GMT+03:00AST-Asia/Qatar, GMT+04:00-RET-Indian/Reunion, GMT+02:00-EET-Europe/Bucharest, GMT +01:00-CET-Europe/Belgrade, GMT+03:00-FET-Europe/Kaliningrad, GMT+04:00-MSK-Europe/ Moscow, GMT+04:00-VOLT-Europe/Volgograd, GMT+04:00-SAMT-Europe/Samara, GMT +06:00-YEKT-Asia/Yekaterinburg, GMT+07:00-OMST-Asia/Omsk, GMT+07:00-NOVT-Asia/ Novosibirsk, GMT+07:00-NOVT-Asia/Novokuznetsk, GMT+08:00-KRAT-Asia/Krasnoyarsk, GMT+09:00-IRKT-Asia/Irkutsk, GMT+10:00-YAKT-Asia/Yakutsk, GMT+11:00-VLAT-Asia/ Vladivostok, GMT+11:00-SAKT-Asia/Sakhalin, GMT+12:00-MAGT-Asia/Magadan, GMT +12:00-PETT-Asia/Kamchatka, GMT+12:00-ANAT-Asia/Anadyr, GMT+02:00-CAT-Africa/
Kigali, GMT+03:00-AST-Asia/Riyadh, GMT+11:00-SBT-Pacific/Guadalcanal, GMT+04:00SCT-Indian/Mahe, GMT+03:00-EAT-Africa/Khartoum, GMT+01:00-CET-Europe/Stockholm, GMT+08:00-SGT-Asia/Singapore, GMT+00:00-GMT-Atlantic/St_Helena, GMT+01:00-CETEurope/Ljubljana, GMT+01:00-CET-Arctic/Longyearbyen, GMT+01:00-CET-Europe/Bratislava, GMT+00:00-GMT-Africa/Freetown, GMT+01:00-CET-Europe/San_Marino, GMT+00:00-GMTAfrica/Dakar, GMT+03:00-EAT-Africa/Mogadishu, GMT-03:00-SRT-America/Paramaribo, GMT +00:00-GMT-Africa/Sao_Tome, GMT-06:00-CST-America/El_Salvador, GMT+02:00-EET-Asia/ Damascus, GMT+02:00-SAST-Africa/Mbabane, GMT-04:00-EDT-America/Grand_Turk, GMT +01:00-WAT-Africa/Ndjamena, GMT+05:00-TFT-Indian/Kerguelen, GMT+00:00-GMT-Africa/ Lome, GMT+07:00-ICT-Asia/Bangkok, GMT+05:00-TJT-Asia/Dushanbe, GMT-10:00-TKTPacific/Fakaofo, GMT+09:00-TLT-Asia/Dili, GMT+05:00-TMT-Asia/Ashgabat, GMT+01:00CET-Africa/Tunis, GMT+13:00-TOT-Pacific/Tongatapu, GMT+02:00-EET-Europe/Istanbul, GMT-04:00-AST-America/Port_of_Spain, GMT+12:00-TVT-Pacific/Funafuti, GMT+08:00-CSTAsia/Taipei, GMT+03:00-EAT-Africa/Dar_es_Salaam, GMT+02:00-EET-Europe/Kiev, GMT +02:00-EET-Europe/Uzhgorod, GMT+02:00-EET-Europe/Zaporozhye, GMT+02:00-EET-Europe/ Simferopol, GMT+03:00-EAT-Africa/Kampala, GMT-10:00-HST-Pacific/Johnston, GMT-11:00SST-Pacific/Midway, GMT+12:00-WAKT-Pacific/Wake, GMT-04:00-EDT-America/New_York, GMT-04:00-EDT-America/Detroit, GMT-04:00-EDT-America/Kentucky/Louisville, GMT-04:00EDT-America/Kentucky/Monticello, GMT-04:00-EDT-America/Indiana/Indianapolis, GMT-04:00EDT-America/Indiana/Vincennes, GMT-04:00-EDT-America/Indiana/Winamac, GMT-04:00EDT-America/Indiana/Marengo, GMT-04:00-EDT-America/Indiana/Petersburg, GMT-04:00-EDTAmerica/Indiana/Vevay, GMT-05:00-CDT-America/Chicago, GMT-05:00-CDT-America/Indiana/ Tell_City, GMT-05:00-CDT-America/Indiana/Knox, GMT-05:00-CDT-America/Menominee, GMT-05:00-CDT-America/North_Dakota/Center, GMT-05:00-CDT-America/North_Dakota/ New_Salem, GMT-05:00-CDT-America/North_Dakota/Beulah, GMT-06:00-MDT-America/ Denver, GMT-06:00-MDT-America/Boise, GMT-06:00-MDT-America/Shiprock, GMT-07:00MST-America/Phoenix, GMT-07:00-PDT-America/Los_Angeles, GMT-08:00-AKDT-America/ Anchorage, GMT-08:00-AKDT-America/Juneau, GMT-08:00-AKDT-America/Sitka, GMT-08:00AKDT-America/Yakutat, GMT-08:00-AKDT-America/Nome, GMT-09:00-HADT-America/Adak, GMT-08:00-MeST-America/Metlakatla, GMT-10:00-HST-Pacific/Honolulu, GMT-03:00-UYTAmerica/Montevideo, GMT+05:00-UZT-Asia/Samarkand, GMT+05:00-UZT-Asia/Tashkent, GMT +01:00-CET-Europe/Vatican, GMT-04:00-AST-America/St_Vincent, GMT-04:30-VET-America/ Caracas, GMT-04:00-AST-America/Tortola, GMT-04:00-AST-America/St_Thomas, GMT+07:00ICT-Asia/Ho_Chi_Minh, GMT+11:00-VUT-Pacific/Efate, GMT+12:00-WFT-Pacific/Wallis, GMT +14:00-WSDT-Pacific/Apia, GMT+03:00-AST-Asia/Aden, GMT+03:00-EAT-Indian/Mayotte, GMT+02:00-SAST-Africa/Johannesburg, GMT+02:00-CAT-Africa/Lusaka, GMT+02:00-CATAfrica/Harare grantQuotaMaxClient The percentage of shared quota to be granted at a time for maxClient Default value: 10 Maximum value: 100 exclusiveQuotaMaxClient The percentage of maxClient to be given to PEs Default value: 80 Maximum value: 100 grantQuotaSpillOver The percentage of shared quota to be granted at a time for spillover Default value: 10 Maximum value: 100 exclusiveQuotaSpillOver The percentage of max limit to be given to PEs Default value: 80 Maximum value: 100 Example
Related Commands clear ns config
unset ns config save ns config show ns config diff ns config
unset ns config
Synopsis unset ns config [-nsvlan] [-IPAddress] [-netmask] [-ifnum] [-tagged] Description Unset the system parameters. Use "unset nsparam" command to unset other netscaler parameters..Refer to the set ns config command for meanings of the arguments. Arguments Example
Related Commands clear ns config set ns config save ns config show ns config diff ns config
save ns config
Synopsis save ns config Description Save the system configuration to the system's FLASH. In a high availability setup, the command is sent to the primary system. The primary system then forwards the command to the secondary system. The entire system configuration is saved to the ns.conf file located in the /nsconfig directory. Backup configuration files are named ns.conf.n. The most recent backup file has the smallest value for n. Arguments message Example
Related Commands clear ns config set ns config unset ns config show ns config
diff ns config
show ns config
Synopsis show ns config Description Display the version, build, and feature information of the system. Note: If you want to see the complete configuration parameters that have been set for the system, use ns runningconfig. Arguments format level IPAddress IP Address of the System. netmask Net Mask Address of the System. mappedIP Mapped IP Address of the System. range The range of Mapped IP addresses to be configured. nsvlan The VLAN (NSVLAN) for the subnet on which the system IP resides. ifnum This option is used to bind the given ports to the NSVLAN. tagged Specifies that the interfaces will be added as 802.1q tagged interfaces. Packets sent on these interface on this VLAN will have an additional 4-byte 802.1q tag which identifies the VLAN. To use 802.1q tagging, the switch connected to the system interfaces must also be configured for tagging. httpPort The HTTP ports on the Web server. maxConn Maximum Number of Connections. maxReq Maxmimum Number of requests that can be handled. cip Insertion of client IP address into the HTTP header. cipHeader The text that is used as the client IP header. cookieversion The version of the cookie inserted by system. secureCookie
enable/disable secure flag for persistence cookie failover Standalone node. systemType The type of the System. Possible Values: Standalone, HA, Cluster primaryIP HA Master Node IP address. pmtuMin The minimum Path MTU. pmtuTimeout The timeout value in minutes. ftpPortRange Port range configured for FTP services. crPortRange Port range for cache redirection services. flags The flags for this entry. timezone Name of the timezone LastConfigChangedTime Time when the configuration was last modified. LastConfigSaveTime Time when the configuration was last saved through savensconfig. systemTime current system time. grantQuotaMaxClient The percentage of shared quota to be granted at a time for maxClient exclusiveQuotaMaxClient The percentage of maxClient to be given to PEs grantQuotaSpillOver The percentage of shared quota to be granted at a time for spillover exclusiveQuotaSpillOver The percentage of max limit to be given to PEs Example
Related Commands clear ns config set ns config unset ns config save ns config diff ns config
diff ns config
Synopsis diff ns config [<config1>] [<config2>] [-outtype ( cli | xml )] [-template] [-ignoreDeviceSpecific] Description Difference between two configuration Arguments config1 Config options. config2 Config options. outtype The format in which result is desired. Possible values: cli, xml template Enable template diff.This will only compare commands given in template file. ignoreDeviceSpecific Suppress device specific differences response Example diff ns config runningconfig savedConfig Related Commands clear ns config set ns config unset ns config save ns config show ns config
set ns param
Synopsis set ns param [-httpPort <port> ...] [-maxConn <positive_integer>] [-maxReq <positive_integer>] [-cip ( ENABLED | DISABLED ) <cipHeader>] [-cookieversion ( 0 | 1 )] [-secureCookie ( ENABLED | DISABLED )] [-pmtuMin <positive_integer>] [-pmtuTimeout <mins>] [-ftpPortRange <int[-int]>] [-crPortRange <int[-int]>] [-timezone <timezone>] [-grantQuotaMaxClient <positive_integer>] [-exclusiveQuotaMaxClient <positive_integer>] [grantQuotaSpillOver <positive_integer>] [-exclusiveQuotaSpillOver <positive_integer>] Description Set the netscaler parameters. Arguments httpPort The HTTP ports on the Web server. This allows the system to perform connection off-load for any client request that has a destination port matching one of these configured ports. Minimum value: 1 maxConn
The maximum number of connections that will be made from the system to the web server(s) attached to it. The value entered here is applied globally to all attached servers. Maximum value: 4294967294 maxReq The maximum number of requests that the system can pass on a particular connection between the system and a server attached to it. Setting this value to 0 allows an unlimited number of requests to be passed. Maximum value: 65535 cip The option to control (enable or disable) the insertion of the actual client IP address into the HTTP header request passed from the client to one, some, or all servers attached to the system. The passed address can then be accessed through a minor modification to the server. l If cipHeader is specified, it will be used as the client IP header. l If it is not specified, then the value that has been set by the set ns config CLI command will be used as the client IP header. Possible values: ENABLED, DISABLED cookieversion The version of the cookie inserted by system. Possible values: 0, 1 secureCookie enable/disable secure flag for persistence cookie Possible values: ENABLED, DISABLED Default value: ENABLED pmtuMin The minimum Path MTU. Default value: 576 Minimum value: 168 Maximum value: 1500 pmtuTimeout The timeout value in minutes. Default value: 10 Minimum value: 1 Maximum value: 1440 ftpPortRange Port range configured for FTP services. Minimum value: 1024 Maximum value: 64000 crPortRange Port range for cache redirection services. Minimum value: 1 Maximum value: 65535 timezone Name of the timezone Possible values: GMT+01:00-CET-Europe/Andorra, GMT+04:00-GSTAsia/Dubai, GMT+04:30-AFT-Asia/Kabul, GMT-04:00-AST-America/Antigua, GMT-04:00AST-America/Anguilla, GMT+01:00-CET-Europe/Tirane, GMT+04:00-AMT-Asia/Yerevan, GMT+01:00-WAT-Africa/Luanda, GMT+13:00-NZDT-Antarctica/McMurdo, GMT+13:00NZDT-Antarctica/South_Pole, GMT-03:00-ROTT-Antarctica/Rothera, GMT-04:00-CLTAntarctica/Palmer, GMT+05:00-MAWT-Antarctica/Mawson, GMT+07:00-DAVT-Antarctica/ Davis, GMT+08:00-WST-Antarctica/Casey, GMT+06:00-VOST-Antarctica/Vostok, GMT+10:00DDUT-Antarctica/DumontDUrville, GMT+03:00-SYOT-Antarctica/Syowa, GMT+11:00-MISTAntarctica/Macquarie, GMT-03:00-ART-America/Argentina/Buenos_Aires, GMT-03:00-ARTAmerica/Argentina/Cordoba, GMT-03:00-ART-America/Argentina/Salta, GMT-03:00-ARTAmerica/Argentina/Jujuy, GMT-03:00-ART-America/Argentina/Tucuman, GMT-03:00-ARTAmerica/Argentina/Catamarca, GMT-03:00-ART-America/Argentina/La_Rioja, GMT-03:00ART-America/Argentina/San_Juan, GMT-03:00-ART-America/Argentina/Mendoza, GMT-03:00WARST-America/Argentina/San_Luis, GMT-03:00-ART-America/Argentina/Rio_Gallegos, GMT-03:00-ART-America/Argentina/Ushuaia, GMT-11:00-SST-Pacific/Pago_Pago, GMT +01:00-CET-Europe/Vienna, GMT+11:00-LHST-Australia/Lord_Howe, GMT+11:00-ESTAustralia/Hobart, GMT+11:00-EST-Australia/Currie, GMT+11:00-EST-Australia/Melbourne, GMT+11:00-EST-Australia/Sydney, GMT+10:30-CST-Australia/Broken_Hill, GMT+10:00EST-Australia/Brisbane, GMT+10:00-EST-Australia/Lindeman, GMT+10:30-CST-Australia/ Adelaide, GMT+09:30-CST-Australia/Darwin, GMT+08:00-WST-Australia/Perth, GMT+08:45CWST-Australia/Eucla, GMT-04:00-AST-America/Aruba, GMT+02:00-EET-Europe/Mariehamn, GMT+04:00-AZT-Asia/Baku, GMT+01:00-CET-Europe/Sarajevo, GMT-04:00-AST-America/
Barbados, GMT+06:00-BDT-Asia/Dhaka, GMT+01:00-CET-Europe/Brussels, GMT+00:00GMT-Africa/Ouagadougou, GMT+02:00-EET-Europe/Sofia, GMT+03:00-AST-Asia/Bahrain, GMT+02:00-CAT-Africa/Bujumbura, GMT+01:00-WAT-Africa/Porto-Novo, GMT-04:00AST-America/St_Barthelemy, GMT-03:00-ADT-Atlantic/Bermuda, GMT+08:00-BNT-Asia/ Brunei, GMT-04:00-BOT-America/La_Paz, GMT-02:00-FNT-America/Noronha, GMT-03:00BRT-America/Belem, GMT-03:00-BRT-America/Fortaleza, GMT-03:00-BRT-America/ Recife, GMT-03:00-BRT-America/Araguaina, GMT-03:00-BRT-America/Maceio, GMT-03:00BRT-America/Bahia, GMT-03:00-BRT-America/Sao_Paulo, GMT-04:00-AMT-America/ Campo_Grande, GMT-04:00-AMT-America/Cuiaba, GMT-03:00-BRT-America/Santarem, GMT-04:00-AMT-America/Porto_Velho, GMT-04:00-AMT-America/Boa_Vista, GMT-04:00AMT-America/Manaus, GMT-04:00-AMT-America/Eirunepe, GMT-04:00-AMT-America/ Rio_Branco, GMT-04:00-EDT-America/Nassau, GMT+06:00-BTT-Asia/Thimphu, GMT+02:00CAT-Africa/Gaborone, GMT+03:00-FET-Europe/Minsk, GMT-06:00-CST-America/Belize, GMT-02:30-NDT-America/St_Johns, GMT-03:00-ADT-America/Halifax, GMT-03:00-ADTAmerica/Glace_Bay, GMT-03:00-ADT-America/Moncton, GMT-03:00-ADT-America/Goose_Bay, GMT-04:00-AST-America/Blanc-Sablon, GMT-04:00-EDT-America/Montreal, GMT-04:00-EDTAmerica/Toronto, GMT-04:00-EDT-America/Nipigon, GMT-04:00-EDT-America/Thunder_Bay, GMT-04:00-EDT-America/Iqaluit, GMT-04:00-EDT-America/Pangnirtung, GMT-05:00-CDTAmerica/Resolute, GMT-05:00-EST-America/Atikokan, GMT-05:00-CDT-America/Rankin_Inlet, GMT-05:00-CDT-America/Winnipeg, GMT-05:00-CDT-America/Rainy_River, GMT-06:00CST-America/Regina, GMT-06:00-CST-America/Swift_Current, GMT-06:00-MDT-America/ Edmonton, GMT-06:00-MDT-America/Cambridge_Bay, GMT-06:00-MDT-America/Yellowknife, GMT-06:00-MDT-America/Inuvik, GMT-07:00-MST-America/Dawson_Creek, GMT-07:00PDT-America/Vancouver, GMT-07:00-PDT-America/Whitehorse, GMT-07:00-PDT-America/ Dawson, GMT+06:30-CCT-Indian/Cocos, GMT+01:00-WAT-Africa/Kinshasa, GMT+02:00-CATAfrica/Lubumbashi, GMT+01:00-WAT-Africa/Bangui, GMT+01:00-WAT-Africa/Brazzaville, GMT+01:00-CET-Europe/Zurich, GMT+00:00-GMT-Africa/Abidjan, GMT-10:00-CKT-Pacific/ Rarotonga, GMT-04:00-CLT-America/Santiago, GMT-06:00-EAST-Pacific/Easter, GMT+01:00WAT-Africa/Douala, GMT+08:00-CST-Asia/Shanghai, GMT+08:00-CST-Asia/Harbin, GMT +08:00-CST-Asia/Chongqing, GMT+08:00-CST-Asia/Urumqi, GMT+08:00-CST-Asia/Kashgar, GMT-05:00-COT-America/Bogota, GMT-06:00-CST-America/Costa_Rica, GMT-04:00-CDTAmerica/Havana, GMT-01:00-CVT-Atlantic/Cape_Verde, GMT+07:00-CXT-Indian/Christmas, GMT+02:00-EET-Asia/Nicosia, GMT+01:00-CET-Europe/Prague, GMT+01:00-CET-Europe/ Berlin, GMT+03:00-EAT-Africa/Djibouti, GMT+01:00-CET-Europe/Copenhagen, GMT-04:00AST-America/Dominica, GMT-04:00-AST-America/Santo_Domingo, GMT+01:00-CET-Africa/ Algiers, GMT-05:00-ECT-America/Guayaquil, GMT-06:00-GALT-Pacific/Galapagos, GMT +02:00-EET-Europe/Tallinn, GMT+02:00-EET-Africa/Cairo, GMT+00:00-WET-Africa/El_Aaiun, GMT+03:00-EAT-Africa/Asmara, GMT+01:00-CET-Europe/Madrid, GMT+01:00-CET-Africa/ Ceuta, GMT+00:00-WET-Atlantic/Canary, GMT+03:00-EAT-Africa/Addis_Ababa, GMT+02:00EET-Europe/Helsinki, GMT+12:00-FJT-Pacific/Fiji, GMT-03:00-FKST-Atlantic/Stanley, GMT +10:00-CHUT-Pacific/Chuuk, GMT+11:00-PONT-Pacific/Pohnpei, GMT+11:00-KOST-Pacific/ Kosrae, GMT+00:00-WET-Atlantic/Faroe, GMT+01:00-CET-Europe/Paris, GMT+01:00-WATAfrica/Libreville, GMT+00:00-GMT-Europe/London, GMT-04:00-AST-America/Grenada, GMT +04:00-GET-Asia/Tbilisi, GMT-03:00-GFT-America/Cayenne, GMT+00:00-GMT-Europe/ Guernsey, GMT+00:00-GMT-Africa/Accra, GMT+01:00-CET-Europe/Gibraltar, GMT-03:00WGT-America/Godthab, GMT+00:00-GMT-America/Danmarkshavn, GMT-01:00-EGT-America/ Scoresbysund, GMT-03:00-ADT-America/Thule, GMT+00:00-GMT-Africa/Banjul, GMT+00:00GMT-Africa/Conakry, GMT-04:00-AST-America/Guadeloupe, GMT+01:00-WAT-Africa/Malabo, GMT+02:00-EET-Europe/Athens, GMT-02:00-GST-Atlantic/South_Georgia, GMT-06:00CST-America/Guatemala, GMT+10:00-ChST-Pacific/Guam, GMT+00:00-GMT-Africa/Bissau, GMT-04:00-GYT-America/Guyana, GMT+08:00-HKT-Asia/Hong_Kong, GMT-06:00-CSTAmerica/Tegucigalpa, GMT+01:00-CET-Europe/Zagreb, GMT-05:00-EST-America/Port-auPrince, GMT+01:00-CET-Europe/Budapest, GMT+07:00-WIT-Asia/Jakarta, GMT+07:00WIT-Asia/Pontianak, GMT+08:00-CIT-Asia/Makassar, GMT+09:00-EIT-Asia/Jayapura, GMT +00:00-GMT-Europe/Dublin, GMT+02:00-IST-Asia/Jerusalem, GMT+00:00-GMT-Europe/ Isle_of_Man, GMT+05:30-IST-Asia/Kolkata, GMT+06:00-IOT-Indian/Chagos, GMT+03:00-
AST-Asia/Baghdad, GMT+03:30-IRST-Asia/Tehran, GMT+00:00-GMT-Atlantic/Reykjavik, GMT+01:00-CET-Europe/Rome, GMT+00:00-GMT-Europe/Jersey, GMT-05:00-EST-America/ Jamaica, GMT+02:00-EET-Asia/Amman, GMT+09:00-JST-Asia/Tokyo, GMT+03:00-EATAfrica/Nairobi, GMT+06:00-KGT-Asia/Bishkek, GMT+07:00-ICT-Asia/Phnom_Penh, GMT +12:00-GILT-Pacific/Tarawa, GMT+13:00-PHOT-Pacific/Enderbury, GMT+14:00-LINTPacific/Kiritimati, GMT+03:00-EAT-Indian/Comoro, GMT-04:00-AST-America/St_Kitts, GMT +09:00-KST-Asia/Pyongyang, GMT+09:00-KST-Asia/Seoul, GMT+03:00-AST-Asia/Kuwait, GMT-05:00-EST-America/Cayman, GMT+06:00-ALMT-Asia/Almaty, GMT+06:00-QYZT-Asia/ Qyzylorda, GMT+05:00-AQTT-Asia/Aqtobe, GMT+05:00-AQTT-Asia/Aqtau, GMT+05:00ORAT-Asia/Oral, GMT+07:00-ICT-Asia/Vientiane, GMT+02:00-EET-Asia/Beirut, GMT-04:00AST-America/St_Lucia, GMT+01:00-CET-Europe/Vaduz, GMT+05:30-IST-Asia/Colombo, GMT +00:00-GMT-Africa/Monrovia, GMT+02:00-SAST-Africa/Maseru, GMT+02:00-EET-Europe/ Vilnius, GMT+01:00-CET-Europe/Luxembourg, GMT+02:00-EET-Europe/Riga, GMT+02:00EET-Africa/Tripoli, GMT+00:00-WET-Africa/Casablanca, GMT+01:00-CET-Europe/Monaco, GMT+02:00-EET-Europe/Chisinau, GMT+01:00-CET-Europe/Podgorica, GMT-04:00-ASTAmerica/Marigot, GMT+03:00-EAT-Indian/Antananarivo, GMT+12:00-MHT-Pacific/Majuro, GMT+12:00-MHT-Pacific/Kwajalein, GMT+01:00-CET-Europe/Skopje, GMT+00:00-GMTAfrica/Bamako, GMT+06:30-MMT-Asia/Rangoon, GMT+08:00-ULAT-Asia/Ulaanbaatar, GMT +07:00-HOVT-Asia/Hovd, GMT+08:00-CHOT-Asia/Choibalsan, GMT+08:00-CST-Asia/Macau, GMT+10:00-ChST-Pacific/Saipan, GMT-04:00-AST-America/Martinique, GMT+00:00-GMTAfrica/Nouakchott, GMT-04:00-AST-America/Montserrat, GMT+01:00-CET-Europe/Malta, GMT+04:00-MUT-Indian/Mauritius, GMT+05:00-MVT-Indian/Maldives, GMT+02:00-CATAfrica/Blantyre, GMT-06:00-CST-America/Mexico_City, GMT-06:00-CST-America/Cancun, GMT-06:00-CST-America/Merida, GMT-06:00-CST-America/Monterrey, GMT-05:00-CDTAmerica/Matamoros, GMT-07:00-MST-America/Mazatlan, GMT-07:00-MST-America/Chihuahua, GMT-06:00-MDT-America/Ojinaga, GMT-07:00-MST-America/Hermosillo, GMT-07:00PDT-America/Tijuana, GMT-08:00-PST-America/Santa_Isabel, GMT-06:00-CST-America/ Bahia_Banderas, GMT+08:00-MYT-Asia/Kuala_Lumpur, GMT+08:00-MYT-Asia/Kuching, GMT+02:00-CAT-Africa/Maputo, GMT+02:00-WAST-Africa/Windhoek, GMT+11:00-NCTPacific/Noumea, GMT+01:00-WAT-Africa/Niamey, GMT+11:30-NFT-Pacific/Norfolk, GMT +01:00-WAT-Africa/Lagos, GMT-06:00-CST-America/Managua, GMT+01:00-CET-Europe/ Amsterdam, GMT+01:00-CET-Europe/Oslo, GMT+05:45-NPT-Asia/Kathmandu, GMT+12:00NRT-Pacific/Nauru, GMT-11:00-NUT-Pacific/Niue, GMT+13:00-NZDT-Pacific/Auckland, GMT +13:45-CHADT-Pacific/Chatham, GMT+04:00-GST-Asia/Muscat, GMT-05:00-EST-America/ Panama, GMT-05:00-PET-America/Lima, GMT-10:00-TAHT-Pacific/Tahiti, GMT-09:30-MARTPacific/Marquesas, GMT-09:00-GAMT-Pacific/Gambier, GMT+10:00-PGT-Pacific/Port_Moresby, GMT+08:00-PHT-Asia/Manila, GMT+05:00-PKT-Asia/Karachi, GMT+01:00-CET-Europe/ Warsaw, GMT-02:00-PMDT-America/Miquelon, GMT-08:00-PST-Pacific/Pitcairn, GMT-04:00AST-America/Puerto_Rico, GMT+02:00-EET-Asia/Gaza, GMT+02:00-EET-Asia/Hebron, GMT +00:00-WET-Europe/Lisbon, GMT+00:00-WET-Atlantic/Madeira, GMT-01:00-AZOT-Atlantic/ Azores, GMT+09:00-PWT-Pacific/Palau, GMT-03:00-PYST-America/Asuncion, GMT+03:00AST-Asia/Qatar, GMT+04:00-RET-Indian/Reunion, GMT+02:00-EET-Europe/Bucharest, GMT +01:00-CET-Europe/Belgrade, GMT+03:00-FET-Europe/Kaliningrad, GMT+04:00-MSK-Europe/ Moscow, GMT+04:00-VOLT-Europe/Volgograd, GMT+04:00-SAMT-Europe/Samara, GMT +06:00-YEKT-Asia/Yekaterinburg, GMT+07:00-OMST-Asia/Omsk, GMT+07:00-NOVT-Asia/ Novosibirsk, GMT+07:00-NOVT-Asia/Novokuznetsk, GMT+08:00-KRAT-Asia/Krasnoyarsk, GMT+09:00-IRKT-Asia/Irkutsk, GMT+10:00-YAKT-Asia/Yakutsk, GMT+11:00-VLAT-Asia/ Vladivostok, GMT+11:00-SAKT-Asia/Sakhalin, GMT+12:00-MAGT-Asia/Magadan, GMT +12:00-PETT-Asia/Kamchatka, GMT+12:00-ANAT-Asia/Anadyr, GMT+02:00-CAT-Africa/ Kigali, GMT+03:00-AST-Asia/Riyadh, GMT+11:00-SBT-Pacific/Guadalcanal, GMT+04:00SCT-Indian/Mahe, GMT+03:00-EAT-Africa/Khartoum, GMT+01:00-CET-Europe/Stockholm, GMT+08:00-SGT-Asia/Singapore, GMT+00:00-GMT-Atlantic/St_Helena, GMT+01:00-CETEurope/Ljubljana, GMT+01:00-CET-Arctic/Longyearbyen, GMT+01:00-CET-Europe/Bratislava, GMT+00:00-GMT-Africa/Freetown, GMT+01:00-CET-Europe/San_Marino, GMT+00:00-GMTAfrica/Dakar, GMT+03:00-EAT-Africa/Mogadishu, GMT-03:00-SRT-America/Paramaribo, GMT +00:00-GMT-Africa/Sao_Tome, GMT-06:00-CST-America/El_Salvador, GMT+02:00-EET-Asia/
Damascus, GMT+02:00-SAST-Africa/Mbabane, GMT-04:00-EDT-America/Grand_Turk, GMT +01:00-WAT-Africa/Ndjamena, GMT+05:00-TFT-Indian/Kerguelen, GMT+00:00-GMT-Africa/ Lome, GMT+07:00-ICT-Asia/Bangkok, GMT+05:00-TJT-Asia/Dushanbe, GMT-10:00-TKTPacific/Fakaofo, GMT+09:00-TLT-Asia/Dili, GMT+05:00-TMT-Asia/Ashgabat, GMT+01:00CET-Africa/Tunis, GMT+13:00-TOT-Pacific/Tongatapu, GMT+02:00-EET-Europe/Istanbul, GMT-04:00-AST-America/Port_of_Spain, GMT+12:00-TVT-Pacific/Funafuti, GMT+08:00-CSTAsia/Taipei, GMT+03:00-EAT-Africa/Dar_es_Salaam, GMT+02:00-EET-Europe/Kiev, GMT +02:00-EET-Europe/Uzhgorod, GMT+02:00-EET-Europe/Zaporozhye, GMT+02:00-EET-Europe/ Simferopol, GMT+03:00-EAT-Africa/Kampala, GMT-10:00-HST-Pacific/Johnston, GMT-11:00SST-Pacific/Midway, GMT+12:00-WAKT-Pacific/Wake, GMT-04:00-EDT-America/New_York, GMT-04:00-EDT-America/Detroit, GMT-04:00-EDT-America/Kentucky/Louisville, GMT-04:00EDT-America/Kentucky/Monticello, GMT-04:00-EDT-America/Indiana/Indianapolis, GMT-04:00EDT-America/Indiana/Vincennes, GMT-04:00-EDT-America/Indiana/Winamac, GMT-04:00EDT-America/Indiana/Marengo, GMT-04:00-EDT-America/Indiana/Petersburg, GMT-04:00-EDTAmerica/Indiana/Vevay, GMT-05:00-CDT-America/Chicago, GMT-05:00-CDT-America/Indiana/ Tell_City, GMT-05:00-CDT-America/Indiana/Knox, GMT-05:00-CDT-America/Menominee, GMT-05:00-CDT-America/North_Dakota/Center, GMT-05:00-CDT-America/North_Dakota/ New_Salem, GMT-05:00-CDT-America/North_Dakota/Beulah, GMT-06:00-MDT-America/ Denver, GMT-06:00-MDT-America/Boise, GMT-06:00-MDT-America/Shiprock, GMT-07:00MST-America/Phoenix, GMT-07:00-PDT-America/Los_Angeles, GMT-08:00-AKDT-America/ Anchorage, GMT-08:00-AKDT-America/Juneau, GMT-08:00-AKDT-America/Sitka, GMT-08:00AKDT-America/Yakutat, GMT-08:00-AKDT-America/Nome, GMT-09:00-HADT-America/Adak, GMT-08:00-MeST-America/Metlakatla, GMT-10:00-HST-Pacific/Honolulu, GMT-03:00-UYTAmerica/Montevideo, GMT+05:00-UZT-Asia/Samarkand, GMT+05:00-UZT-Asia/Tashkent, GMT +01:00-CET-Europe/Vatican, GMT-04:00-AST-America/St_Vincent, GMT-04:30-VET-America/ Caracas, GMT-04:00-AST-America/Tortola, GMT-04:00-AST-America/St_Thomas, GMT+07:00ICT-Asia/Ho_Chi_Minh, GMT+11:00-VUT-Pacific/Efate, GMT+12:00-WFT-Pacific/Wallis, GMT +14:00-WSDT-Pacific/Apia, GMT+03:00-AST-Asia/Aden, GMT+03:00-EAT-Indian/Mayotte, GMT+02:00-SAST-Africa/Johannesburg, GMT+02:00-CAT-Africa/Lusaka, GMT+02:00-CATAfrica/Harare grantQuotaMaxClient The percentage of shared quota to be granted at a time for maxClient Default value: 10 Maximum value: 100 exclusiveQuotaMaxClient The percentage of maxClient to be given to PEs Default value: 80 Maximum value: 100 grantQuotaSpillOver The percentage of shared quota to be granted at a time for spillover Default value: 10 Maximum value: 100 exclusiveQuotaSpillOver The percentage of max limit to be given to PEs Default value: 80 Maximum value: 100 Example
Related Commands unset ns param show ns param
unset ns param
Synopsis unset ns param [-ftpPortRange] [-crPortRange] [-timezone] [-httpPort] [-maxConn] [-maxReq] [-cip] [-cipHeader] [cookieversion] [-secureCookie] [-pmtuMin] [-pmtuTimeout] [-grantQuotaMaxClient] [-exclusiveQuotaMaxClient] [grantQuotaSpillOver] [-exclusiveQuotaSpillOver] Description Unset the netscaler parameters..Refer to the set ns param command for meanings of the arguments. Arguments Example Related Commands set ns param show ns param
show ns param
Synopsis show ns param Description Display the version, build, and feature information of the system. Note: If you want to see the complete configuration parameters that have been set for the system, use ns runningconfig. Arguments format level httpPort The HTTP ports on the Web server. maxConn Maximum Number of Connections. maxReq Maxmimum Number of requests that can be handled. cip Insertion of client IP address into the HTTP header. cipHeader The text that will be used as the client IP header. cookieversion The version of the cookie inserted by system. secureCookie enable/disable secure flag for persistence cookie pmtuMin The minimum Path MTU. pmtuTimeout The timeout value in minutes.
ftpPortRange Port range configured for FTP services. crPortRange Port range for cache redirection services. timezone Name of the timezone grantQuotaMaxClient The percentage of shared quota to be granted at a time for maxClient exclusiveQuotaMaxClient The percentage of maxClient to be given to PEs grantQuotaSpillOver The percentage of shared quota to be granted at a time for spillover exclusiveQuotaSpillOver The percentage of max limit to be given to PEs Example Related Commands set ns param unset ns param
clear ns acls6
Synopsis clear ns acls6 Description Clear all configured ACL6. This operation does not require an explicit apply. Arguments Example clear ns acls6 Related Commands add ns acl6 rm ns acl6 apply ns acls6 renumber ns acls6
apply ns acls6
Synopsis apply ns acls6 Description Commit the ACL6 in the configuration space to the system. This is required after an ACL6 is added or modified.
Arguments Example apply ns acls6 Related Commands add ns acl6 rm ns acl6 set ns acl6 enable ns acl6 disable ns acl6 clear ns acls6 renumber ns acls6
renumber ns acls6
Synopsis renumber ns acls6 Description Reorganize ACL6 priorities. This will introduce gaps between ACL6 priorities. This command does not affect the behaviour of ACLs. Arguments Example renumber acls6 Related Commands apply acls6 clear acls6 clear ns acls6 apply ns acls6
renumber ns pbrs
Synopsis renumber ns pbrs Description Reorganize Policy Based Routing(PBR) priorities. This will introduce gaps between PBR priorities. This command does not affect the behaviour of PBRs. Arguments Example renumber pbrs Related Commands apply ns pbrs
clear ns pbrs
clear ns pbrs
Synopsis clear ns pbrs Description Clear all configured Policy Based Routing(PBR). This operation does not require an explicit 'apply pbrs' commad. Arguments Example clear ns pbrs Related Commands add ns pbr rm ns pbr renumber ns pbrs apply ns pbrs
apply ns pbrs
Synopsis apply ns pbrs Description Commit the Policy Based Routing(PBR) in the configuration space to the system. This is required after you add PBRs or modify the PBRs. Arguments Example apply ns pbrs Related Commands add ns pbr rm ns pbr set ns pbr enable ns pbr disable ns pbr renumber ns pbrs clear ns pbrs
show ns connectiontable
Synopsis show ns connectiontable [<filterexpression>] [-detail <detail> ...]
Description Display the current TCP/IP connection table Arguments filterexpression The maximum length of filter expression is 255 and it can be of following format: <expression> [<relop> <expression>] <relop> = ( && | || ) connectiontable supports two types of filter expressions: Classic Expressions: <expression> = the expression string in the format: <qualifier> <operator> <qualifier-value> <qualifier> = SOURCEIP. <qualifier-value> = A valid IP address. <qualifier> = SOURCEPORT. <qualifier-value> = A valid port number. <qualifier> = DESTIP. <qualifier-value> = A valid IP address. <qualifier> = DESTPORT. <qualifier-value> = A valid port number. <qualifier> = IP. <qualifier-value> = A valid IP address. <qualifier> = PORT. <qualifier-value> = A valid port number. <qualifier> = IDLETIME. <qualifier-value> = A positive integer indicating the idle time. <qualifier> = SVCNAME. <qualifier-value> = The name of a service. <qualifier> = VSVRNAME. <qualifier-value> = The name of a vserver. <qualifier> = INTF <qualifier-value> = A valid interface id in the form of x/y (n/x/y in case of cluster interface). <qualifier> = VLAN <qualifier-value> = A valid VLAN ID. <qualifier> = STATE. <qualifier-value> = ( CLOSE_WAIT | CLOSED | CLOSING | ESTABLISHED | FIN_WAIT_1 | FIN_WAIT_2 | LAST_ACK | LISTEN | SYN_RECEIVED | SYN_SENT | TIME_WAIT ) <qualifier> = SVCTYPE. <qualifier-value> = ( HTTP | FTP | TCP | UDP | SSL | SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS | RPCCLNT | DNS | ADNS | SNMP | RTSP | DHCPRA | ANY | MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP | MYSQL | MSSQL | UNKNOWN ) <operator> = ( == | eq | != | neq | > | gt | < | lt | >= | ge | <= | le | BETWEEN ) Default Expressions: <expression> =: CONNECTION.<qualifier>.<qualifiermethod>.(<qualifier-value>) <qualifier> = SRCIP <qualifier-method> = [ EQ | NE ] <qualifiervalue> = A valid IPv4 address example = CONNECTION.SRCIP.EQ(127.0.0.1) <qualifier> = DSTIP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.DSTIP.EQ(127.0.0.1) <qualifier> = IP <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid IPv4 address. example = CONNECTION.IP.EQ(127.0.0.1) <qualifier> = SRCPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.SRCPORT.EQ(80) <qualifier> = DSTPORT <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A valid port number. example = CONNECTION.DSTPORT.EQ(80) <qualifier> = PORT <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid port number. example = CONNECTION.PORT.EQ(80) <qualifier> = INTF <qualifier-method> = [ EQ | NE ] <qualifier-value> = A valid interface id in the form of x/y (n/x/y in case of cluster interface). examle = CONNECTION.INTF.EQ("0/1/1") <qualifier> = VLANID <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifiervalue> = A valid VLAN ID. example = CONNECTION.VLANID.EQ(0) <qualifier> = IDLETIME <qualifier-method> = [ EQ | NE | GT | GE | LT | LE ] <qualifier-value> = A positive integer indicating the idletime. example = CONNECTION.IDLETIME.LT(100) <qualifier> = TCPSTATE <qualifier-method> = [ EQ | NE ] <qualifier-value> = ( CLOSE_WAIT | CLOSED | CLOSING | ESTABLISHED | FIN_WAIT_1 | FIN_WAIT_2 | LAST_ACK | LISTEN | SYN_RECEIVED | SYN_SENT | TIME_WAIT | NOT_APPLICABLE) example = CONNECTION.TCPSTATE.EQ(LISTEN) <qualifier> = SERVICE_TYPE <qualifier-method> = [ EQ | NE ] <qualifier-value> = ( SVC_HTTP | FTP | TCP | UDP | SSL | SSL_BRIDGE | SSL_TCP | NNTP | RPCSVR | RPCSVRS | RPCCLNT | SVC_DNS | ADNS | SNMP | RTSP | DHCPRA | ANY | MONITOR | MONITOR_UDP | MONITOR_PING | SIP_UDP | SVC_MYSQL | SVC_MSSQL | SERVICE_UNKNOWN ) example = CONNECTION.SERVICE_TYPE.EQ(ANY) link Display link information if available name Display name instead of IP for local entities detail Display options for the connection table.
summary fullValues SOURCEIP Source IP of the connection. SOURCEPORT Source port of the connection. DESTIP Destination IP of the connection. DESTPORT Destination port of the connection. SVCTYPE Protocol supported by the connection. IDLETIME Time since last activity was detected on the connection. STATE Current TCP/IP state of the connection. linkSourceIP Source IP of the link connection. linkSourcePort Source port of the link connection. linkDestIP Destination IP of the link connection. linkDestPort Destination port of the link connection. linkServiceType Protocol supported by the link connection. linkIdleTime Time since last activity was detected on link connection. linkState TCP/IP current state of link connection. entityName NetScaler entity name for the connection. linkEntityName NetScaler entity name for link connection. connectionNumber Connection numberNOTE: This attribute is deprecated.Deprecated in favour of NSA_CONNID. linkConnectionNumber Link connection numberNOTE: This attribute is deprecated.Deprecated in favour of NSA_LINK_CONNID. connid Unique transaction number for the connection. linkConnid
Unique transaction number for the peer connection. filterFlags flags used to store display options optionFlags flags used to store TCP options like Sack, WS mss Client side MSS for the connection - used in server SYN. retxRetryCnt Retransmission retry count for the connection. rcvWnd Received Advertised Window for the connection. advWnd Sent advertised window for the connection. sndCwnd sent congestion window for the connection. iss Initial send sequence number for the connection. irs Initial receive sequence number for the connection. rcvNxt next expecting seq number for the connection. maxAck current running max ack sent for the connection. sndNxt next bytes seq number for the connection. sndUnAck Most recently received ACK for the connection. httpEndSeq HTTP parsing tracking seq number for the connection. httpState HTTP Protocol state for the connection. trCount Max reuests allowed per connection. priority priority of the connection. httpReqVer current HTTP request version on the connection. httpRequest current HTTP request type on the connection. httpRspCode current response type on the connection. rttSmoothed
smoothed RTT value of the connection. rttVariance RTT variance for the connection. outoforderPkts held packets on the connection. count count linkOptionFlag Link connection's TCP option flag for Sack and WS linkMSS Client side MSS for the Link connection - used in server SYN linkRetxRetryCnt Retransmission retry count for the Link connection. linkRcvWnd Received Advertised Window for the Link connection. linkAdvWnd Sent advertised window for the Link connection. linkSndCwnd Send congestion window for the Link connection. linkISS Initial send seq number for the Link connection. linkIRS Initial receive seq number for the Link connection. linkRcvNxt Next expecting seq number on the Link connection. linkMaxAck Current running maximum ack sent on the Link connection. linkSndNxt Next bytes seq number for the Link connection. linkSndUnAck Most recently received ACK on the Link connection. linkHttpEndSeq HTTP parsing tracking seq number on the Link connection. linkHttpState HTTP protocol state on the Link connection. linkTrCount Max requests per connection for Link connection. linkPriority Priority for the Link connection. linkHttpReqVer HTTP current request version on Link connection. linkHttpReq
HTTP current request type on Link connection. linkHttpRspCode Current response type on link connection. linkRttSmoothed Smoothed RTT value on link connection. linkRttVariance RTT variance on Link connection. linkHeldPkts Held packets on Link connection. targetnodeidnnm NNM connection target node ID. sourcenodeidnnm NNM connection source node ID. channelidnnm NNM connection channel ID. refcountnnm total number of references. nnmdetails NNM connection state. msgversionnnm nnm message version. count stateflag Example
Related Commands
show ns limitSessions
Synopsis show ns limitSessions <limitIdentifier> [-detail] Description Display rate limit sessions. Arguments limitIdentifier The name of the rate limit identifer. detail Displays the individual hash values timeout The time remaining on the session before a flush can be attempted. If active transactions are present the session will not be flushed hits
The number of times this entry was hit. drop The number of times action was taken. number The hash of the matched selectlets. name The string formed by gathering selectlet values. unit Total computed hash of the matched selectlets. flags Used internally to identify ip addresses. referenceCount Total number of transactions pointing to this entry. Its the sum total of the connection and bandwidth references maxBandwidth The current bandwidth SelectorIPV61 First IPV6 address gathered. SelectorIPV62 Second IPV6 address gathered. flag Used internally to identify ipv6 addresses. count stateflag Example Related Commands clear ns limitSessions
clear ns limitSessions
Synopsis clear ns limitSessions <limitIdentifier> Description Arguments limitIdentifier The name of the rate limit identifer. Example Related Commands show ns limitSessions
show ns persistencesession
Synopsis Description Get all Sessions corresponding to a Vserver NOTE: This command is deprecated.Moved to LB command group Arguments name The name of the virtual server. summary fullValues type The netmask of this IP. srcIP SOURCE IP. srcIPv6 SOURCE IPv6 ADDRESS. destIP DESTINATION IP. destIPv6 DESTINATION IPv6 ADDRESS. flags IPv6 FLAGS. destPort Destination port. vServerName Virtual server name. timeout Persistent Session timeout. referenceCount Reference Count. sipCallID SIP CALLID.NOTE: This attribute is deprecated.Replaced by "persistenceParam" field persistenceParam Specific persistence information . Callid in case of SIP_CALLID persistence entry , RTSP session id in case of RTSP_SESSIONID persistence entry. count stateflag Example show ns persistencesession vipname
Related Commands clear ns persistencesession
clear ns persistencesession
Synopsis Description Use this command to clear/flush persistence sessions NOTE: This command is deprecated.Moved to LB command group Arguments vServer The name of the LB vserver whose persistence sessions are to be flushed. If not specified, all persistence sessions will be flushed . Example clear persistenceSessions -vserver vip1 Related Commands show ns persistencesession
set ns hostName
Synopsis set ns hostName <hostName> Description Sets the host name for the system. Arguments hostName Desired host name. Example set ns hostname nspri Related Commands show ns hostName
show ns hostName
Synopsis show ns hostName Description Display the host name of the system. Arguments format level
hostName Host name Example show ns hostname Related Commands set ns hostName
flush ns surgeQ
Synopsis flush ns surgeQ [-name <string> [-serverName <string> <port>]] Description Use this command to flush the connections that are waiting in SurgeQ. Arguments name The name of the entity.Entity can be a Vserver, Service or a Servicegroup. serverName Name of the Server bound to the entity(Servicegroup). Example To flush the surgeQ system wide, use the command: flush ns SurgeQ. To flush the surgeQ specific to a vserver/service/svcgrp use the command: flush ns SurgeQ -name <name> To flush the surgeQ specific to a svcgrp member, use the command: flush ns surgeQ [-name <string> [serverName <string> <port>]] Related Commands
enable ns feature
Synopsis enable ns feature <feature> ... Description Enable a specific feature. Arguments feature Name of the feature(s) reqFeature requested feature(s). Example enable ns feature sc This CLI command enables the SureConnect feature. Related Commands disable ns feature show ns feature
disable ns feature
Synopsis disable ns feature <feature> ... Description Disable a specified feature or features. Arguments feature Name of the feature(s) reqFeature requested feature(s). Example Related Commands enable ns feature show ns feature
show ns feature
Synopsis show ns feature Description Display the current status of System features. Arguments WL Web Logging. SP Surge Protection. LB Load Balancing. CS Content Switching. CR Cache Redirect. SC Sure Connect. CMP Compression. PQ Priority Queuing. SSL Secure Sockets Layer. GSLB Global Server Load Balancing.
HDOSP DOS Protection. Routing Routing.NOTE: This attribute is deprecated. CF Content Filter. IC Integrated Caching. SSLVPN SSL VPN. AAA AAA OSPF OSPF Routing. RIP RIP Routing. BGP BGP Routing. REWRITE Rewrite. IPv6PT IPv6 protocol translation AppFw Application Firewall. RESPONDER Responder. HTMLInjection HTML Injection. push NetScaler Push. AppFlow AppFlow. CloudBridge CloudBridge. ISIS ISIS Routing. CH Call Home. Example Related Commands enable ns feature
disable ns feature
enable ns mode
Synopsis enable ns mode <Mode> ... Description Enable a specified mode. Arguments Mode The name of the mode to be enabled. reqFeature Required feature. Example This CLI command enables the system's client keep-alive feature: enable ns mode CKA Related Commands disable ns mode show ns mode
disable ns mode
Synopsis disable ns mode <Mode> ... Description Disable the specified feature or features. Arguments Mode The feature to be disabled. reqFeature Required feature. Example This example shows the command to disable the system's client keep-alive feature: disable ns mode CKA Related Commands enable ns mode show ns mode
show ns mode
Synopsis show ns mode
Description Display the state of Fast Ramp, Layer 2, USIP, client keep-alive, TCP buffering, and MAC-based forwarding features. Arguments FR Fast Ramp. L2 Layer 2 mode. USIP Use Source IP. CKA Client Keep-alive. TCPB TCP Buffering. MBF MAC-based forwarding. Edge Edge configuration. USNIP Use Subnet IP. L3 Layer 3 mode (ip forwarding). PMTUD Path MTU Discovery. SRADV Static Route Advertisement. DRADV Direct Route Advertisement. IRADV Intranet Route Advertisement. SRADV6 Ipv6 Static Route Advertisement. DRADV6 Ipv6 Direct Route Advertisement. BridgeBPDUs BPDU Bridging Mode. Example
Related Commands enable ns mode disable ns mode
set ns dhcpParams
Synopsis set ns dhcpParams [-dhcpClient ( ON | OFF )] [-saveroute ( ON | OFF )] Description Set the dhcp-client parameters. Arguments dhcpClient Setting this argument to ON makes the netscaler to enable dhcp-client for acquiring IP from the DHCP server in the next boot. Setting it to OFF disables the dhcp-client in the next boot. Possible values: ON, OFF Default value: OFF saveroute If this flag is set, then DHCP acquired routes are saved during saveconfig. Possible values: ON, OFF Default value: OFF Example
Related Commands unset ns dhcpParams show ns dhcpParams
unset ns dhcpParams
Synopsis unset ns dhcpParams [-dhcpClient] [-saveroute] Description Use this command to remove ns dhcpParams settings.Refer to the set ns dhcpParams command for meanings of the arguments. Arguments Example
Related Commands set ns dhcpParams show ns dhcpParams
show ns dhcpParams
Synopsis show ns dhcpParams
Description Show dhcp-client parameters. Arguments format level dhcpClient ON, if DHCP client active on next reboot, else OFF IPAddress DHCP acquired IP netmask DHCP acquired Netmask hostRtGw DHCP acquired Gateway running DHCP mode saveroute DHCP acquired gateway save flag Example
Related Commands set ns dhcpParams unset ns dhcpParams
release ns dhcpIp
Synopsis release ns dhcpIp Description Release IP acquired by DHCP client Arguments Example
Related Commands
set ns spParams
Synopsis set ns spParams [-baseThreshold <integer>] [-throttle <throttle>]
Description Set the base threshold and/or the throttle rate for surge protection. Arguments baseThreshold The base threshold. This is the maximum number of server connections that can be opened before surge protection is activated. Maximum value: 32767 throttle The throttle rate, which is the rate at which the system opens connections to the server. The different names of throttle are the keywords: relaxed, normal, and aggressive. Possible values: Aggressive, Normal, Relaxed Example set ns spparams -baseThreshold 1000 -throttle aggressive set ns spparams -throttle relaxed Related Commands unset ns spParams show ns spParams
unset ns spParams
Synopsis unset ns spParams [-baseThreshold] [-throttle] Description Use this command to remove ns spParams settings.Refer to the set ns spParams command for meanings of the arguments. Arguments Example
Related Commands set ns spParams show ns spParams
show ns spParams
Synopsis show ns spParams Description Display the surge protection configuration on the system. This includes the base threshold value and throttle value. These values are set using the setnsparams command. Arguments format level
baseThreshold The base threshold. This is the maximum number of server connections that can be open before surge protection is activated. throttle The throttle rate, which is the rate at which the system opens connections to the server. The different names of throttle are the keywords: relaxed, normal, and aggressive. Table Table. Example > show ns spparams Surge Protection parameters: BaseThreshold: 200 Throttle: Normal Done Related Commands set ns spParams unset ns spParams
set ns tcpbufParam
Synopsis set ns tcpbufParam [-size <KBytes>] [-memLimit <MBytes>] Description Display the current TCP buffer size. The command also displays the percentage of the system memory that is used for buffering. Arguments size The size (in KBytes) of the TCP buffer per connection. Default value: 64 Minimum value: 4 Maximum value: 20480 memLimit The maximum memory that can be used for buffering, in megabytes. Default value: 64 Example
Related Commands unset ns tcpbufParam show ns tcpbufParam
unset ns tcpbufParam
Synopsis unset ns tcpbufParam [-size] [-memLimit] Description Use this command to remove ns tcpbufParam settings.Refer to the set ns tcpbufParam command for meanings of the arguments.
Arguments Example
Related Commands set ns tcpbufParam show ns tcpbufParam
show ns tcpbufParam
Synopsis show ns tcpbufParam Description Display the current TCP buffer size. The command also displays the percentage of the system memory that is used for buffering. Arguments format level size The size (in KBytes) of the TCP buffer per connection. memLimit The maximum memory that can be used for buffering, in megabytes. Example An example of this command's output is as follows: TCP buffer size: 64KBytes TCP buffer percentage: 50%
Related Commands set ns tcpbufParam unset ns tcpbufParam
set ns tcpParam
Synopsis set ns tcpParam [-WS ( ENABLED | DISABLED )] [-WSVal <positive_integer>] [-SACK ( ENABLED | DISABLED )] [-learnVsvrMSS ( ENABLED | DISABLED )] [-maxBurst <positive_integer>] [-initialCwnd <positive_integer>] [-delayedAck <positive_integer>] [-downStateRST ( ENABLED | DISABLED )] [-nagle ( ENABLED | DISABLED )] [-limitedPersist ( ENABLED | DISABLED )] [-oooQSize <positive_integer>] [ackOnPush ( ENABLED | DISABLED )] [-maxPktPerMss <integer>] [-pktPerRetx <integer>] [-minRTO <integer>] [-slowStartIncr <integer>] [-maxDynServerProbes <positive_integer>] [-synHoldFastGiveup <positive_integer>] [maxSynholdPerprobe <positive_integer>] [-maxSynhold <positive_integer>] [-mssLearnInterval <positive_integer>] [-mssLearnDelay <positive_integer>] [-maxTimeWaitConn <positive_integer>] [-maxSynAckRetx <positive_integer>] [-synAttackDetection ( ENABLED | DISABLED )]
Description Set the TCP settings on the NetScaler Arguments WS The state of WS Possible values: ENABLED, DISABLED Default value: DISABLED WSVal Window Scaling Factor used Default value: 4 Maximum value: 8 SACK The state of SACK Possible values: ENABLED, DISABLED Default value: DISABLED learnVsvrMSS enable/disable MSS learning for vservers Possible values: ENABLED, DISABLED Default value: DISABLED maxBurst Max-Burst Factor used Default value: 6 Minimum value: 1 Maximum value: 255 initialCwnd Intial value of TCP cwnd used Default value: 4 Minimum value: 1 Maximum value: 44 recvBuffSize TCP Receive buffer size Default value: 8190 Minimum value: 8190 Maximum value: 20971520 delayedAck Delayed acknowledgement timeout (in millisec) Default value: 200 Minimum value: 10 Maximum value: 300 downStateRST Flag to switch on RST on down services Possible values: ENABLED, DISABLED Default value: DISABLED nagle Whether to enable Nagle's algorithm on connections Possible values: ENABLED, DISABLED Default value: DISABLED limitedPersist Whether to limit the number of persist(zero window) probes Possible values: ENABLED, DISABLED Default value: ENABLED oooQSize Maximum size of out-of-order packet queue (0 means infinite) Default value: 64 Maximum value: 65535 ackOnPush Enable immediate ACK on receiving packet with PUSH flag Possible values: ENABLED, DISABLED Default value: ENABLED maxPktPerMss Set maximum packtes to be sent for each MSS in CWND for packet count based congestion control Maximum value: 1460 pktPerRetx Set maximum packets should be retransmitted on partial ACK case Default value: 1 Minimum value: 1 Maximum value: 100 minRTO Minimum TCP RTO(in millisec) Default value: 1000 Minimum value: 10 Maximum value: 64000 slowStartIncr
Set TCP slow start increment factor Default value: 2 Minimum value: 1 Maximum value: 100 maxDynServerProbes Max server probes in 10ms Default value: 7 Minimum value: 1 Maximum value: 65535 synHoldFastGiveup Max threshold after which NetScaler reduces the number of retries for server probes Default value: 1024 Minimum value: 256 Maximum value: 65535 maxSynholdPerprobe Maximum number of SYN allowed to be queued per probe PCB Default value: 128 Minimum value: 1 Maximum value: 255 maxSynhold Maximum number of SYN that NetScaler can hold while probing for backend services Default value: 16384 Minimum value: 256 Maximum value: 65535 mssLearnInterval Time period (in seconds) for which the backend service MSS are sampled for Vserver MSS learning Default value: 180 Minimum value: 1 Maximum value: 1048576 mssLearnDelay Vserver MSS learning delay(seconds) Default value: 3600 Minimum value: 1 Maximum value: 1048576 maxTimeWaitConn max connection limit for FIN TIME WAIT Default value: 7000 Minimum value: 1 KAprobeUpdateLastactivity Update last activity for KA probes Possible values: ENABLED, DISABLED Default value: ENABLED maxSynAckRetx Max limit for syn+ack retransmissions in a given interval Default value: 100 Minimum value: 100 Maximum value: 1048576 synAttackDetection Enable/disable synattack detection Possible values: ENABLED, DISABLED Default value: ENABLED Example
Related Commands unset ns tcpParam show ns tcpParam
unset ns tcpParam
Synopsis unset ns tcpParam [-WS] [-WSVal] [-SACK] [-learnVsvrMSS] [-maxBurst] [-initialCwnd] [-delayedAck] [downStateRST] [-nagle] [-limitedPersist] [-oooQSize] [-ackOnPush] [-maxPktPerMss] [-pktPerRetx] [-minRTO] [-slowStartIncr] [-maxDynServerProbes] [-synHoldFastGiveup] [-maxSynholdPerprobe] [-maxSynhold] [mssLearnInterval] [-mssLearnDelay] [-maxTimeWaitConn] [-maxSynAckRetx] [-synAttackDetection] Description Use this command to remove ns tcpParam settings.Refer to the set ns tcpParam command for meanings of the arguments.
Arguments Example
Related Commands set ns tcpParam show ns tcpParam
show ns tcpParam
Synopsis show ns tcpParam Description Display the TCP settings on the NetScaler Arguments format level WS The state of WS WSVal Window Scaling Factor used SACK The state of SACK learnVsvrMSS enable/disable MSS learning for vservers maxBurst Max-Burst Factor used initialCwnd Intial value of TCP cwnd used recvBuffSize TCP Receive buffer size delayedAck Delayed acknowledgement timeout (in millisec) downStateRST Flag to switch on RST on down services nagle Whether to enable Nagle's algorithm on connections limitedPersist Whether to limit the number of persist(zero window) probes oooQSize Maximum size of out-of-order packet queue (0 means infinite) ackOnPush
Immediate ACK on PUSH packet maxPktPerMss Maximum packets per MSS pktPerRetx Maximum packets per retransmission minRTO Minimum TCP RTO(in millisec) slowStartIncr TCP slowstart increment factor maxDynServerProbes Max server probes in 10ms synHoldFastGiveup Max threshold after which NetScaler reduces the number of retries for server probes maxSynholdPerprobe Maximum number of SYN allowed to be queued per probe PCB maxSynhold Maximum number of SYN that NetScaler can hold while probing for backend services mssLearnInterval Time period (in seconds) for which the backend service MSS are sampled for Vserver MSS learning mssLearnDelay Vserver MSS learning delay(seconds) maxTimeWaitConn max connection limit for FIN TIME WAIT KAprobeUpdateLastactivity Update last activity for KA probesNOTE: This attribute is deprecated.This option has been moved tcpProfile maxSynAckRetx Max limit for syn+ack retransmissions in a given interval synAttackDetection Enable/disable synattack detection Example
Related Commands set ns tcpParam unset ns tcpParam
set ns httpParam
Synopsis set ns httpParam [-dropInvalReqs ( ON | OFF )] [-markHttp09Inval ( ON | OFF )] [-markConnReqInval ( ON | OFF )] [-insNsSrvrHdr ( ON | OFF ) [<nsSrvrHdr>]] [-logErrResp ( ON | OFF )] [-conMultiplex ( ENABLED | DISABLED )] [-maxReusePool <positive_integer>]
Description Set configurable HTTP parameters on the NetScaler Arguments dropInvalReqs Whether to drop invalid HTTP requests/responses Possible values: ON, OFF Default value: OFF markHttp09Inval Whether to mark HTTP/0.9 requests as invalid Possible values: ON, OFF Default value: OFF markConnReqInval Whether to mark CONNECT requests as invalid Possible values: ON, OFF Default value: OFF insNsSrvrHdr Enable/disable NetScaler server header insertion for NetScaler generated HTTP responses. Possible values: ON, OFF Default value: OFF logErrResp Whether to log HTTP error responses generated by NetScaler Possible values: ON, OFF Default value: ON conMultiplex Connection multiplexing Possible values: ENABLED, DISABLED Default value: ENABLED maxReusePool Maximum connections in reusepool Example set ns httpParam -dropInvalReqs ON
Related Commands unset ns httpParam show ns httpParam
unset ns httpParam
Synopsis unset ns httpParam [-dropInvalReqs] [-markHttp09Inval] [-markConnReqInval] [-insNsSrvrHdr] [-nsSrvrHdr] [logErrResp] [-conMultiplex] [-maxReusePool] Description Use this command to remove ns httpParam settings.Refer to the set ns httpParam command for meanings of the arguments. Arguments Example
Related Commands set ns httpParam
show ns httpParam
show ns httpParam
Synopsis show ns httpParam Description Display configured HTTP parameters on the NetScaler Arguments format level dropInvalReqs Whether to drop invalid HTTP requests/responses markHttp09Inval Whether to mark HTTP/0.9 requests as invalid markConnReqInval Whether to mark CONNECT requests as invalid insNsSrvrHdr Enable/disable NetScaler server header insertion for NetScaler generated HTTP responses. nsSrvrHdr The server header value to be inserted. logErrResp Whether to log HTTP error responses conMultiplex Connection multiplexing maxReusePool Maximum connections in reusepool Example
Related Commands set ns httpParam unset ns httpParam
set ns weblogparam
Synopsis set ns weblogparam -bufferSizeMB <positive_integer> Description Set the current web log buffer size.
Arguments bufferSizeMB The buffer size (in MB) allocated for log transaction data on the system. Maximum value is limited by the memory available in the system. Minimum value: 1 Maximum value: 4294967294LU Example
Related Commands show ns weblogparam
show ns weblogparam
Synopsis show ns weblogparam Description Display the current size of the buffer, which is used to store log transactions. Arguments format level bufferSizeMB Buffer size in MB. Example
Related Commands set ns weblogparam
set ns rateControl
Synopsis set ns rateControl [-tcpThreshold <positive_integer>] [-udpThreshold <positive_integer>] [-icmpThreshold <positive_integer>] Description Configure udp/tcp/icmp packet rate controls for any application that is not configured at System(ie., direct access to the backend through System). This rate limit should be specified in the number of packets to allow per 10ms. Arguments tcpThreshold The number of SYNs permitted per 10 milli second. udpThreshold The number of UDP packets permitted per 10 milli second. icmpThreshold The number of ICMP packets permitted per 10 milli second. Default value: 100
Example The following command will set the SYN rate to 100, icmp rate to 10 and the udp rate to unlimited. set ns ratecontrol -tcpThreshold 100 -udpThreshold 0 -icmpThreshold 10 The 'show ns rate control' command can be used to view the current settings of the rate controls. > show ns ratecontrol UDP threshold: 0 per 10 ms TCP threshold: 0 per 10 ms ICMP threshold: 100 per 10 ms Done
Related Commands unset ns rateControl show ns rateControl
unset ns rateControl
Synopsis unset ns rateControl [-tcpThreshold] [-udpThreshold] [-icmpThreshold] Description Use this command to remove ns rateControl settings.Refer to the set ns rateControl command for meanings of the arguments. Arguments Example
Related Commands set ns rateControl show ns rateControl
show ns rateControl
Synopsis show ns rateControl Description Check the current rate control values. Arguments format level tcpThreshold The number of SYNs permitted per 10 milli second. udpThreshold The number of UDP packets permitted per 10 milli second. icmpThreshold The number of ICMP packets permitted per 10 milli second.
Example By default, there is no rate control for TCP/UDP and for ICMP it will be 100. The output of the "show ns ratecontrol" command, with default setting, > show ns ratecontrol UDP threshold: 0 per 10 ms TCP threshold: 0 per 10 ms ICMP threshold: 100 per 10 ms Done
Related Commands set ns rateControl unset ns rateControl
set ns rpcNode
Synopsis set ns rpcNode <IPAddress> {-password } [-srcIP <ip_addr|ipv6_addr|*>] [-secure ( YES | NO )] Description Set the authentication attributes associated with peer System node. All System nodes use remote procedure calls to communicate. Arguments IPAddress The IP address of the node. This has to be in same subnet as NSIP. password The password to be used in authentication with the peer System node. srcIP The src ip to be used in communiction with the peer System node. secure The state of the channel when talking to the node. Channel can be secure or insecure. Possible values: YES, NO Example Example-1: Failover configuration In a failover configuration define peer NS as: add node 1 10.101.4.87 Set peer ha-unit's password as: set ns rpcnode 10.101.4.87 -password testpass secure yes System will now use the configured password to authenticate with its failover unit. Example-2: GSLB configuration In a GSLB configuration define peer NS GSLB site as: add gslb site us_east_coast remote 206.123.3.4 Set peer GSLB-NS's password as: set ns rpcnode 206.123.3.4 -password testrun System will now use the configured password to authenticate with east-coast GSLB site.
Related Commands unset ns rpcNode show ns rpcNode
unset ns rpcNode
Synopsis unset ns rpcNode <IPAddress> [-password] [-srcIP] [-secure]
Description Use this command to remove ns rpcNode settings.Refer to the set ns rpcNode command for meanings of the arguments. Arguments Example
Related Commands set ns rpcNode show ns rpcNode
show ns rpcNode
Synopsis show ns rpcNode [<IPAddress>] Description Display a list of nodes currently communicating using RPC. All nodes use remote procedure calls to communicate. Arguments IPAddress The IP address of the node. This has to be in same subnet as NSIP. summary fullValues format level password Password. retry The reference count.NOTE: This attribute is deprecated.The argument was a debugging aid and not required any longer. srcIP The src ip used in communiction with the peer System node. secure The state of the channel when talking to the node. Channel can be secure or insecure. count stateflag Example Following example shows list of nodes communicating using RPC: > sh rpcnode 1) IPAddress: 10.101.4.84 Password: ..8a7b474124957776b56cf03b28 Srcip: 1.1.1.1 2) IPAddress: 10.101.4.87 Password: ..ca2a035465d22c Srcip: 2.2.2.2 Done
Related Commands set ns rpcNode unset ns rpcNode
set ns idletimeout
Synopsis Description Set the pcb/natpcb idletimeout. NOTE: This command is deprecated. Arguments tcpsvr Set the idletimeout for server side pcb. tcpclt Set the idletimeout for client side pcb. nontcpsvrclt Set the idletimeout for natpcb. Default value: 120 Minimum value: 1 Example set ns idletimeout -tcpsvr 120 set ns idletimeout -tcpclt 120 set ns idletimeout -nontcpsvrclt 120 Related Commands unset ns idletimeout show ns idletimeout
unset ns idletimeout
Synopsis Description Use this command to remove ns idletimeout settings.Refer to the set ns idletimeout command for meanings of the arguments.NOTE: This command is deprecated. Arguments Example
Related Commands set ns idletimeout show ns idletimeout
show ns idletimeout
Synopsis
Description Display the global setting of pcb/natpcb idletimeout. NOTE: This command is deprecated.This command is deprecated in favour of 'set ns timeout' Arguments format level tcpsvr Set the idletimeout for server side pcb. tcpclt Set the idletimeout for client side pcb. nontcpsvrclt Set the idletimeout for natpcb. Example
Related Commands set ns idletimeout unset ns idletimeout
set ns timeout
Synopsis set ns timeout [-zombie <positive_integer>] [-httpClient <positive_integer>] [-httpServer <positive_integer>] [-tcpClient <positive_integer>] [-tcpServer <positive_integer>] [-anyClient <positive_integer>] [-anyServer <positive_integer>] [-halfclose <positive_integer>] [-nontcpZombie <positive_integer>] [-ReducedFinTimeOut <positive_integer>] [-NewConnIdleTimeOut <positive_integer>] Description Set various timeout values for NetScaler device. Caution: Modifying these values may affect system performance. Arguments zombie Timer interval(in seconds) for zombie process that cleanup inactive TCP connections Default value: 120 Minimum value: 1 Maximum value: 600 client Client idle timeout (in seconds). If zero, the service-type default value is taken when service is created. Maximum value: 18000 server Server idle timeout (in seconds). If zero, the service-type default is taken when service is created. Maximum value: 18000 httpClient HTTP client idle timeout (in seconds) Maximum value: 18000 httpServer HTTP server idle timeout (in seconds) Maximum value: 18000
tcpClient TCP client idle timeout (in seconds) Maximum value: 18000 tcpServer TCP server idle timeout (in seconds) Maximum value: 18000 anyClient ANY client idle timeout (in seconds) Maximum value: 18000 anyServer ANY server idle timeout (in seconds) Maximum value: 18000 halfclose Half-closed connection timeout (in seconds) Default value: 10 Minimum value: 1 Maximum value: 600 nontcpZombie Timer interval(in seconds) for zombie process that cleanup inactive IP NAT connections Default value: 60 Minimum value: 1 Maximum value: 600 ReducedFinTimeOut Timer interval(in seconds) for NATPCB for tcp flow Default value: 30 Minimum value: 1 Maximum value: 300 NewConnIdleTimeOut Timer interval(in seconds) for new NATPCB for tcp connections. Default value: 4 Minimum value: 1 Maximum value: 20 Example set ns timeout -zombie 200
Related Commands unset ns timeout show ns timeout
unset ns timeout
Synopsis unset ns timeout [-zombie] [-httpClient] [-httpServer] [-tcpClient] [-tcpServer] [-anyClient] [-anyServer] [-halfclose] [-nontcpZombie] [-ReducedFinTimeOut] [-NewConnIdleTimeOut] Description Use this command to remove ns timeout settings.Refer to the set ns timeout command for meanings of the arguments. Arguments Example
Related Commands set ns timeout show ns timeout
show ns timeout
Synopsis show ns timeout Description Display various timeout values for NetScaler device. The timeouts having default values are not displayed. Arguments format level zombie Timer interval(in seconds) for zombie process that cleanup inactive TCP connections Minimum value: 1 Maximum value: 600 Default value: 120 client Client idle timeout (in seconds). If zero, the service-type default value is taken when service is created. server Server idle timeout (in seconds). If zero, the service-type default is taken when service is created. httpClient HTTP client idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 httpServer HTTP server idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 tcpClient TCP client idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 tcpServer TCP server idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 anyClient ANY client idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 anyServer ANY server idle timeout (in seconds) Minimum value: 0 Maximum value: 18000 halfclose Half-closed connection timeout (in seconds) Minimum value: 1 Maximum value: 600 Default value: 10 nontcpZombie Timer interval(in seconds) for zombie process that cleanup inactive IP NAT connections Minimum value: 1 Maximum value: 600 Default value: 60 ReducedFinTimeOut Timer interval(in seconds) for NATPCB for tcp flow NewConnIdleTimeOut Timer interval(in seconds) for new NATPCB for tcp connections Example show ns timeout
Related Commands set ns timeout unset ns timeout
show ns hardware
Synopsis show ns hardware Description Displays hardware and product related information like SystemId, HostId, SerialId. Arguments hwdescription Hardware and it's ports detail. sysId System id. manufactureDay Manufacturing day. manufactureMonth Manufacturing month. manufactureYear Manufacturing year. cpufrequncy CPU Frequency. hostId host id. host host id. serialNo Serial no. encodedSerialNo Encoded serial no. Example
Related Commands
show ns events
Synopsis show ns events [<eventNo>] Description display the events
Arguments eventNo Last retrieved event no. This command will return all events after that. time Event no. eventcode event Code. devid Device Name. devname Device Name. text Event no. data0 additional event information. data1 additional event information. data2 additional event information. data3 additional event information. count stateflag Example show ns events
Related Commands
set ns encryptionParams
Synopsis set ns encryptionParams -method <method> [-keyValue ] Description Set parameters for content encryption and decryption. Arguments method The cipher method (and key length) used to encrypt and decrypt content. The default method is AES256. Possible values: NONE, RC4, DES3, AES128, AES192, AES256 keyValue The base64-encoded key generation number, method, and key value. The parameter should be omitted when the encryption method is being changed, but can be specified with an empty string argument ("") for the generation of a new key value for the current encryption method. The
parameter is passed implicitly, with its automatically generated value, to the NetScaler Packet Engines even when it is not specified in the command. This enables the appliance to save the key value to the configuration file and to enable propagation of the key value to the secondary appliance in an HA pair. Example set ns encryptionParams -method aes128 Related Commands show ns encryptionParams
show ns encryptionParams
Synopsis show ns encryptionParams Description Display the parameters in effect for content encryption. Arguments format level method The cipher method (and key length) used to encrypt and decrypt content. Example
Related Commands set ns encryptionParams
show ns rollbackcmd
Synopsis show ns rollbackcmd [-fileName <input_filename>] [-outtype ( cli | xml )] Description Rollback commands for the ones specified in input file Arguments fileName Input file for generating rollback commands outtype The format in which result is desired. Possible values: cli, xml Example show ns rollbackcmd -file <file_name>
Related Commands
stat ns memory
Synopsis stat ns memory [<pool>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display NetScaler feature memory statistics Arguments pool Feature name count devno stateflag Allocation failure (AllocF) Memory allocation failure for particular feature. Percentage of memory allocated (Alloc(%)) Percentage of NetScaler memory used by the feature. Total memory Allocated (KB) (CurAlloc(KB)) Total current NetScaler memory available for use by the feature, in kilobytes. Example
Related Commands stat ns stat ns acl stat ns acl6 stat ns simpleacl stat ns simpleacl6 stat ns pbr stat ns pbr6
set ns appflowParam
Synopsis
Description Set AppFlow parameters. NOTE: This command is deprecated. Arguments templateRefresh
IPFIX template refresh interval (in seconds). Default value: 600 Minimum value: 60 Maximum value: 3600 udpPmtu MTU to be used for IPFIX UDP packets. Default value: 1472 Minimum value: 128 Maximum value: 1472 httpUrl Enable AppFlow HTTP URL logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpCookie Enable AppFlow HTTP cookie logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpReferer Enable AppFlow HTTP referer logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpMethod Enable AppFlow HTTP method logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpHost Enable AppFlow HTTP host logging. Possible values: ENABLED, DISABLED Default value: DISABLED httpUserAgent Enable AppFlow HTTP user-agent logging. Possible values: ENABLED, DISABLED Default value: DISABLED clientTrafficOnly Control whether AppFlow records should be generated only for client-side traffic. Possible values: YES, NO Default value: NO Example set ns appflowParam -templateRefresh 240 Related Commands unset ns appflowParam show ns appflowParam
unset ns appflowParam
Synopsis Description Use this command to remove ns appflowParam settings.Refer to the set ns appflowParam command for meanings of the arguments.NOTE: This command is deprecated. Arguments Example
Related Commands set ns appflowParam show ns appflowParam
show ns appflowParam
Synopsis
Description Display AppFlow parameters. NOTE: This command is deprecated.This command is deprecated in favor of 'show appflow param' Arguments summary fullValues format level templateRefresh IPFIX template refresh interval (in seconds). udpPmtu MTU to be used for IPFIX UDP packets. httpUrl Enable AppFlow HTTP URL logging. httpCookie Enable AppFlow HTTP cookie logging. httpReferer Enable AppFlow HTTP referer logging. httpMethod Enable AppFlow HTTP method logging. httpHost Enable AppFlow HTTP host logging. httpUserAgent Enable AppFlow HTTP user-agent logging. clientTrafficOnly Control whether AppFlow records should be generated only for client-side traffic. Example
Related Commands set ns appflowParam unset ns appflowParam
add ns pbr6
Synopsis add ns pbr6 <name> <action> [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] [nextHop <nextHopVal>] [-nextHopVlan <positive_integer>] Description Add an IPv6 PBR to the System configuration. Each inbound IPv6 packet is matched against configured PBRs and routed accordingly. This command adds the IPv6 PBR to the configuration space. To commit this PBR, one should apply the PBR6. Arguments name Alphanumeric name of the PBR6. action Action associated with the PBR6. Possible values: ALLOW, DENY srcIPv6 Source IPv6 address (range). srcPort Source port (range). destIPv6 Destination IPv6 address (range). destPort Destination port (range). srcMac Source MAC address. protocol IPv6 protocol name. Possible values: ICMPV6, TCP, UDP protocolNumber IPv6 protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan VLAN number. Minimum value: 1 Maximum value: 4094 interface Physical interface name. priority Priority of the PBR6. (Sequence of execution) Minimum value: 1 Maximum value: 80000 state State of the PBR6. Possible values: ENABLED, DISABLED Default value: XACLENABLED msr Enable/disable Monitored Static Route(MSR) on this route. Possible values: ENABLED, DISABLED Default value: DISABLED nextHop
The Next Hop IPv6 address. nextHopVlan VLAN number to be used for link local nexthop . Minimum value: 1 Maximum value: 4094 Example add ns pbr6 rule1 ALLOW -srcport 45-1024 -destIPv6 2001::45 -nexthop 2001::49 Related Commands clear ns pbr6 apply ns pbr6 renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6
renumber ns pbr6
Synopsis renumber ns pbr6 Description Reorganize PBR6 priorities. This will introduce gaps between PBR6 priorities. This command does not affect the behaviour of PBRs. Arguments Example renumber pbr6 Related Commands apply pbr6 clear pbr6 add ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6
clear ns pbr6 apply ns pbr6
rm ns pbr6
Synopsis rm ns pbr6 <name> ... Description Remove a PBR6 configuration. To commit this operation, one should apply the PBR6. Arguments name Name of the PBR6 to be deleted. Example rm ns pbr6 rule1 Related Commands apply ns pbr6 clear ns pbr6 add ns pbr6 renumber ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6
set ns pbr6
Synopsis set ns pbr6 <name> [-action ( ALLOW | DENY )] [-srcIPv6 [<operator>] <srcIPv6Val>] [-srcPort [<operator>] <srcPortVal>] [-destIPv6 [<operator>] <destIPv6Val>] [-destPort [<operator>] <destPortVal>] [-srcMac <mac_addr>] [-protocol <protocol> | -protocolNumber <positive_integer>] [-vlan <positive_integer>] [-interface <interface_name>] [-priority <positive_integer>] [-state ( ENABLED | DISABLED )] [-msr ( ENABLED | DISABLED ) [-monitor <string>]] [-nextHop <nextHopVal>] [-nextHopVlan <positive_integer>] Description Modify a PBR6. To commit this modified PBR6, use 'apply pbr6' command. Arguments name Alphanumeric name of the PBR6. action Action associated with the PBR6. Possible values: ALLOW, DENY srcIPv6
Source IPv6 address (range). srcPort Source Port (range). destIPv6 Destination IPv6 address (range). destPort Destination Port (range). srcMac Source MAC address. protocol IPv6 protocol name. Possible values: ICMPV6, TCP, UDP protocolNumber IPv6 protocol number (decimal). Minimum value: 1 Maximum value: 255 vlan VLAN number. Minimum value: 1 Maximum value: 4094 interface Physical interface name. priority Priority of the PBR6. (Sequence of execution) Minimum value: 1 Maximum value: 80000 state State of the PBR6. Possible values: ENABLED, DISABLED Default value: XACLENABLED msr Enable/disable Monitored Static Route(MSR) on this route. Possible values: ENABLED, DISABLED Default value: DISABLED nextHop The Next Hop IPv6 address. nextHopVlan VLAN number to be used for link local nexthop . Minimum value: 1 Maximum value: 4094 Example set ns pbr6 rule1 -srcPort 50
Related Commands clear ns pbr6 apply ns pbr6 add ns pbr6 renumber ns pbr6 rm ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6
show ns pbr6
unset ns pbr6
Synopsis unset ns pbr6 <name> [-srcIPv6] [-srcPort] [-destIPv6] [-destPort] [-srcMac] [-protocol] [-icmpType] [-interface] [msr] [-monitor] [-nextHop] [-nextHopVlan] [-vlan] [-nextHopVal] Description Modify PBR6 configuration. To commit this modified PBR6, use 'apply pbr6' command..Refer to the set ns pbr6 command for meanings of the arguments. Arguments Example unset ns pbr6 rule1 -srcPort Related Commands set ns pbr6 clear ns pbr6 apply ns pbr6 add ns pbr6 renumber ns pbr6 rm ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6
enable ns pbr6
Synopsis enable ns pbr6 <name> ... Description Enable an PBR6. To commit this operation, one should apply the PBR6. Arguments name Name of the PBR6 to be enabled. Example enable ns pbr6 rule1 Related Commands apply ns pbr6 clear ns pbr6 add ns pbr6
renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6
disable ns pbr6
Synopsis disable ns pbr6 <name> ... Description Disable an PBR6. To commit this operation, one should apply the PBR6. Arguments name Name of the PBR6 to be disabled. Example disable ns pbr6 rule1 Related Commands apply ns pbr6 clear ns pbr6 add ns pbr6 renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 stat ns pbr6 show ns pbr6
stat ns pbr6
Synopsis stat ns pbr6 [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display PBR6 statistics. Arguments name PBR6 Name.
count devno stateflag Allow PBR6 hits (PBR6Allow) Total packets that matched the PBR6 with action ALLOW Deny PBR6 hits (PBR6Deny) Total packets that matched PBR6 with action DENY PBR6 hits (PBR6TotHits) Total packets that matched one of the configured PBR6 PBR6 misses (PBR6Miss) Total packets that did not match any PBR6 Hits for this PBR6 (PBR6Hits) Number of times the pbr6 was hit Example stat pbr6
Related Commands add ns pbr6 renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 show ns pbr6 clear ns pbr6 apply ns pbr6 stat ns stat ns acl stat ns acl6 stat ns simpleacl stat ns simpleacl6 stat ns pbr stat ns memory
show ns pbr6
Synopsis show ns pbr6 [<name>] [-detail]
Description Display the PBR6. If name is specified, then only that particular PBR6 information is displayed. If it is not specified, all configured PBR6 are displayed. Arguments name Name of the PBR6. detail To get a detailed view. summary fullValues format level action Action associated with the PBR6. srcMac Source MAC address. stateflag PBR6 state flag. protocol Protocol number in IPv6 header or name. protocolNumber Protocol number in IPv6 header or name. srcPortVal Source Port (range). destPortVal Destination Port (range). srcIPv6Val Source IPv6 address (range). destIPv6Val Destination IPv6 address (range). vlan VLAN number. state State of the PBR6. kernelstate Commit status of the PBR6. interface Physical interface name. hits Number of hits of this PBR6. priority Priority of the PBR6. (Sequence of execution)
operator Logical operator. operator Logical operator. operator Logical operator. operator Logical operator. msr Whether Monitored Static Route(MSR) is enabled or disabled. monitor The name of the monitor. state If this route is UP/DOWN. totalprobes The total number of probes sent. totalfailedprobes The total number of failed probes. failedprobes Number of the current failed monitoring probes. monStatCode The code indicating the monitor response. monStatParam1 First parameter for use with message code. monStatParam2 Second parameter for use with message code. monStatParam3 Third parameter for use with message code. nextHopVal Nexthop IPv6 address. nextHopVlan VLAN number to be used for link local nexthop . data Internal data of this route. count Example show ns pbr6 rule1 1) Name: r1 Action: DENY srcIPv6 = 2001::1 destIPv6 srcMac: Protocol: Vlan: Interface: Active Status: ENABLED Applied Status: NOTAPPLIED Priority: 10 Hits: 0 Nexthop:
Related Commands add ns pbr6
renumber ns pbr6 rm ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 clear ns pbr6 apply ns pbr6
clear ns pbr6
Synopsis clear ns pbr6 Description Clear all configured PBR6 rules. This operation does not require an explicit apply. Arguments Example clear ns pbr6
Related Commands add ns pbr6 rm ns pbr6 renumber ns pbr6 set ns pbr6 unset ns pbr6 enable ns pbr6 disable ns pbr6 stat ns pbr6 show ns pbr6 apply ns pbr6
apply ns pbr6
Synopsis apply ns pbr6 Description Commit the PBR6 in the configuration space to the system. This is required after an PBR6 is added or modified.
Arguments Example apply ns pbr6
Related Commands add ns pbr6 rm ns pbr6 set ns pbr6 enable ns pbr6 disable ns pbr6 renumber ns pbr6 unset ns pbr6 stat ns pbr6 show ns pbr6 clear ns pbr6
Chapter
28
Ntp Commands
Topics: add ntp server rm ntp server set ntp server unset ntp server show ntp server enable ntp sync disable ntp sync show ntp sync show ntp status set ntp param unset ntp param show ntp param
966 | Citrix NetScaler 10 | Ntp Commands
add ntp server

Synopsis add ntp server (<serverIP> | <serverName>) [-minpoll <positive_integer>] [-maxpoll <positive_integer>] [-autokey | -key <positive_integer>] Description Add NTP server Arguments serverIP IP address of the NTP server. serverName Fully qualified domain name of the NTP server. minpoll Specifies the minimum poll intervals for NTP messages, in seconds to the power of two. Value defaults to 6 (64 s), but can be decreased to a lower limit of 4 (16 s). Default value: NS_NTP_MINPOLL_DEFAULT_VALUE Minimum value: 4 maxpoll Specifies the maximum poll intervals for NTP messages, in seconds to the power of two. Value defaults to 10 (1,024 s), but can be increased to an upper limit of 17 (36.4 h). Default value: NS_NTP_MAXPOLL_DEFAULT_VALUE Maximum value: 17 autokey Specifies if autokey is to be used for the specified server key Specifies the key to be used for the specified server Minimum value: 1 Maximum value: 65534 Example
Related Commands rm ntp server set ntp server unset ntp server show ntp server
rm ntp server
Synopsis rm ntp server (<serverIP> | <serverName>) Description Remove NTP server entry Arguments serverIP
Citrix NetScaler 10 | Ntp Commands | 967
IP address of the NTP server. serverName Fully qualified domain name of the NTP server. Example
Related Commands add ntp server set ntp server unset ntp server show ntp server
set ntp server

Synopsis set ntp server (<serverIP> | <serverName>) [-minpoll <positive_integer>] [-maxpoll <positive_integer>] [preferredNtpServer ( YES | NO )] [-autokey | -key <positive_integer>] Description Modify the NTP server entries. Arguments serverIP IP address of the NTP server. serverName Fully qualified domain name of the NTP server. minpoll Specifies the minimum poll intervals for NTP messages, in seconds to the power of two. Value defaults to 6 (64 s), but can be decreased to a lower limit of 4 (16 s) Default value: NS_NTP_MINPOLL_DEFAULT_VALUE Minimum value: 4 maxpoll Specifies the maximum poll intervals for NTP messages, in seconds to the power of two. Value defaults to 10 (1,024 s), but can be increased to an upper limit of 17 (36.4 h). Default value: NS_NTP_MAXPOLL_DEFAULT_VALUE Maximum value: 17 preferredNtpServer Specifies if the server is preferred one Possible values: YES, NO Default value: NO autokey Specifies if autokey is to be used for the specified server key Specifies the key to be used for the specified server Minimum value: 1 Maximum value: 65534 Example
Related Commands add ntp server
rm ntp server unset ntp server show ntp server
unset ntp server

Synopsis unset ntp server [<serverIP>] [<serverName>] [-minpoll] [-maxpoll] [-preferredNtpServer] [-autokey] [-key] Description Use this command to remove ntp server settings.Refer to the set ntp server command for meanings of the arguments. Arguments Example
Related Commands add ntp server rm ntp server set ntp server show ntp server
show ntp server

Synopsis show ntp server [<serverIP> | <serverName>] Description Show NTP server information. Arguments serverIP IP address of the NTP server. serverName Fully qualified domain name of the NTP server. summary fullValues format level minpoll Minimum poll interval of the server in secs. maxpoll Maximum poll interval of the server in secs. preferredNtpServer
Specifies if the server is preferred one autokey Specifies if autokey is to be used for the specified server key Specifies the key to be used for the specified server count stateflag Example
Related Commands add ntp server rm ntp server set ntp server unset ntp server
enable ntp sync

Synopsis enable ntp sync Description Enable NTP synchronization Arguments Example
Related Commands disable ntp sync show ntp sync
disable ntp sync

Synopsis disable ntp sync Description Disable NTP synchronization Arguments Example
Related Commands enable ntp sync show ntp sync
show ntp sync

Synopsis show ntp sync Description Show NTP sync info Arguments state Show NTP status Example
Related Commands enable ntp sync disable ntp sync
show ntp status

Synopsis show ntp status Description Show NTP Status Arguments response Example
Related Commands
set ntp param

Synopsis set ntp param [-authentication ( YES | NO )] [-trustedkey <positive_integer> ...] [-autokeyLogsec <positive_integer>] [-revokeLogsec <positive_integer>] Description Set values for NTP parameters
Arguments authentication Specifies if NTP AUTH is enabled or not. Default is YES. Possible values: YES, NO Default value: YES trustedkey Specifies the trusted keys entered. Minimum value: 1 Maximum value: 65534 autokeyLogsec Specifies the interval between regenerations of the session key list used with the Autokey protocol, as a power of 2 in seconds. Default value: 12 Maximum value: 32 revokeLogsec Specifies the interval between re-randomization of certain cryptographic values used by the Autokey scheme, as a power of 2 in seconds. Default value: 16 Maximum value: 32 Example
Related Commands unset ntp param show ntp param
unset ntp param

Synopsis unset ntp param [-authentication] [-trustedkey] [-autokeyLogsec] [-revokeLogsec] Description Use this command to remove ntp param settings.Refer to the set ntp param command for meanings of the arguments. Arguments Example
Related Commands set ntp param show ntp param
show ntp param

Synopsis show ntp param Description Get values for NTP parameters Arguments format
level authentication Specifies if NTP AUTH is enabled or not. Default is YES. trustedkey Specifies the trusted keys entered. autokeyLogsec Specifies the interval between regenerations of the session key list used with the Autokey protocol, as a power of 2 in seconds. revokeLogsec Specifies the interval between re-randomization of certain cryptographic values used by the Autokey scheme, as a power of 2 in seconds. Example
Related Commands set ntp param unset ntp param
Chapter
29
Policy Commands
Topics: add policy expression rm policy expression set policy expression unset policy expression show policy expression add policy map rm policy map show policy map add policy patClass rm policy patClass bind policy patClass unbind policy patClass show policy patClass add policy patset rm policy patset bind policy patset unbind policy patset show policy patset add policy dataset rm policy dataset bind policy dataset unbind policy dataset show policy dataset add policy httpCallout rm policy httpCallout set policy httpCallout unset policy httpCallout show policy httpCallout add policy stringmap rm policy stringmap set policy stringmap unset policy stringmap bind policy stringmap unbind policy stringmap show policy stringmap
974 | Citrix NetScaler 10 | Policy Commands
add policy expression

Synopsis add policy expression <name> <value> [-comment <string>] [-clientSecurityMessage <string>] Description Create an expression. Arguments name The name of the expression that will be created. value The expression string. description Description for the expression. comment Comments associated with this expression. clientSecurityMessage The client security message that will be displayed on failure of this expression.Only relevant for end point check expressions. Example
Related Commands rm policy expression set policy expression unset policy expression show policy expression
rm policy expression
Synopsis rm policy expression <name> ... Description Remove a previously defined expression. If the expression is part of a policy or filter, you must remove the policy or filter before removing the expression. Arguments name The name of the expression. Example
Citrix NetScaler 10 | Policy Commands | 975
Related Commands add policy expression set policy expression unset policy expression show policy expression
set policy expression

Synopsis set policy expression <name> [<value>] [-comment <string>] [-clientSecurityMessage <string>] Description This command modifies an existing expression. Arguments name The name of the expression. value The expression string. description Description for the expression. comment Comments associated with this expression. clientSecurityMessage The client security message that will be displayed on failure of this expression. Only relevant for end point check expressions. Example
Related Commands add policy expression rm policy expression unset policy expression show policy expression
unset policy expression

Synopsis unset policy expression <name> [-comment] [-clientSecurityMessage] Description Use this command to remove policy expression settings.Refer to the set policy expression command for meanings of the arguments.
Arguments Example
Related Commands add policy expression rm policy expression set policy expression show policy expression
show policy expression

Synopsis show policy expression [<name> | -type ( CLASSIC | ADVANCED )] Description Display the expressions defined in the system. Arguments name The name of the expression. if no name is given then all expressions will be displayed. type The type of expression. This is for input only. Possible values: CLASSIC, ADVANCED summary fullValues format level value The expression string. hits The total number of hits. piHits The total number of hits. type The type of expression. This is for output only. clientSecurityMessage The client security message that will be displayed on failure of the client security check. description Description for the expression. comment Comments associated with this expression. stateflag
flag isDefault A value of true is returned if it is a default policy expression. count Example
Related Commands add policy expression rm policy expression set policy expression unset policy expression
add policy map

Synopsis add policy map <mapPolicyName> -sd <string> [-su <string>] [-td <string>] [-tu <string>] Description Create a policy to map publicly-known domain name to a target domain name for a reverse proxy virtual server used in the cache redirection feature. Optionally, a source and target URL can also be specified. The map policy created can be associated with a reverse proxy cache redirection virtual server using the ###bind cr vserver### command. There can be only one default map policy for a domain. Arguments mapPolicyName The name of the map policy to be created. sd The source domain name which is publicly known. This is the domain name with which a client request arrives to a reverse proxy virtual server for cache redirection on the system. su The source URL. The format to specify the argument is: / [[prefix] [*]] [.suffix] td The domain name sent to the server. It replaces the source domain name. tu The target URL.The format to specify the argument is: / [[prefix] [*]] [.suffix] Example Example 1 The following example creates a default map policy (map1) for the source domain www.a.com. Any client requests with this source domain in the host header is changed to www.real_a.com. add policy map map2 -sd www.a.com -td www.real.a.com Example 2 This example shows how to create a URL map policy (map2) if you want to translate / sports.html in the incoming request to /news.html in addition to mapping the source domain www.a.com to www.real_a.com in the outgoing request. add policy map map2 -sd www.a.com td www.real_a.com -su /sports.html -tu /news.html These type of map policies, called "URL map
policies," have the following restrictions: l URL map policies belonging to www.a.com cannot be added without first adding a default map policy as described in Example 1. l If a source suffix has been specified for URL map policy, a destination suffix must also be specified. l If an exact URL has been specified as the source, then the target URL should also be exact URL. l If there is a source prefix in the URL, there must be also a destination prefix in the URL.
Related Commands rm policy map show policy map
rm policy map
Synopsis rm policy map <mapPolicyName> Description Remove the map policies. Note: Before removing the map policy, you must first unbind the map policy from the reverse proxy virtual server. Arguments mapPolicyName The name of the map policy. Example
Related Commands add policy map show policy map
show policy map

Synopsis show policy map [<mapPolicyName>] Description Display the map policies that have been configured and the related map policy information. Arguments mapPolicyName The name of the map policy to be displayed. summary fullValues format level
sd The source domain name which is publicly known. This is the domain name with which a client request arrives to a reverse proxy virtual server for cache redirection on the system. su The source URL. td The domain name sent to the server. tu The target URL. targetName The expression string. count stateflag Example
Related Commands add policy map rm policy map
add policy patClass

Synopsis
Description Add a patclass. Each patclass is identified by a name. More patterns(strings) can be associated with it later. NOTE: This command is deprecated.This command is deprecated in favor of 'add policy patset' Arguments name The name of the patclass. The name must not exceed 127 characters. string The string associated with the patclass. Example add policy patclass pat1 foo
Related Commands rm policy patClass bind policy patClass unbind policy patClass show policy patClass
rm policy patClass
Synopsis
Description Remove the patclass created by the add patclass command. Once the patclass is removed, all the expressions referring it would have undefined value. NOTE: This command is deprecated.This command is deprecated in favor of 'rm policy patset' Arguments name The name of the patclass. Example rm policy patclass pat1
Related Commands add policy patClass bind policy patClass unbind policy patClass show policy patClass
bind policy patClass

Synopsis
Description Bind string(s) to a patclass. NOTE: This command is deprecated.This command is deprecated in favor of 'bind policy patset' Arguments name The name of the patclass. string The string associated with the patclass. Example bind policy patclass pat1 bar xyz
Related Commands add policy patClass
rm policy patClass unbind policy patClass show policy patClass
unbind policy patClass

Synopsis
Description Unbind string(s) from a patclass. NOTE: This command is deprecated.This command is deprecated in favor of 'unbind policy patset' Arguments name The name of the patclass. string The string associated with the patclass. Example unbind policy patclass pat1 bar xyz
Related Commands add policy patClass rm policy patClass bind policy patClass show policy patClass
show policy patClass

Synopsis
Description Display the configured patclass(s). NOTE: This command is deprecated.This command is deprecated in favor of 'show policy patset' Arguments name The name of the patclass. summary fullValues format
level stateflag string The string associated with the patclass. index The index of the string associated with the patclass. charset The character set of the string associated with patset. description Description of the patclass isDefault count Example show policy patclass pat1
Related Commands add policy patClass rm policy patClass bind policy patClass unbind policy patClass
add policy patset

Synopsis add policy patset <name> Description Add a patset. Each patset is identified by a name. Arguments name The name of the patset. The name must not exceed 127 characters. Example add policy patset pat1
Related Commands rm policy patset bind policy patset unbind policy patset show policy patset
rm policy patset
Synopsis rm policy patset <name> Description Remove the patset created by the add patset command. Arguments name The name of the patset. Example rm policy patset pat1
Related Commands add policy patset bind policy patset unbind policy patset show policy patset
bind policy patset

Synopsis bind policy patset <name> <string> [-index <positive_integer>] [-charset ( ASCII | UTF_8 )] Description Bind string to a patset. If first patern(string) is bound using index label then next bind statements to that patset should provide index, and vice versa Arguments name The name of the patset. string The string associated with the patset. Example bind policy patset pat1 bar -index 2
Related Commands add policy patset rm policy patset unbind policy patset show policy patset
unbind policy patset

Synopsis unbind policy patset <name> <string> ... [-charset ( ASCII | UTF_8 )] Description Unbind string(s) from a patset. Arguments name The name of the patset. string The string associated with the patset. Example unbind policy patset pat1 bar xyz Related Commands add policy patset rm policy patset bind policy patset show policy patset
show policy patset

Synopsis show policy patset [<name>] Description Display the configured patset(s). Arguments name The name of the patset. summary fullValues format level stateflag string The string associated with the patset. index The index of the string associated with the patset.
charset The character set of the string associated with patset. description Description of the patset isDefault count Example show policy patset pat1 Related Commands add policy patset rm policy patset bind policy patset unbind policy patset
add policy dataset

Synopsis add policy dataset <name> <type> Description Add a dataset. Each dataset is identified by a name. Arguments name The name of the set. The name must not exceed 127 characters. type The type of set: ipv4, ipv6, number Possible values: ipv4, number, ipv6 Example add policy dataset ts1 -type IPV4 Related Commands rm policy dataset bind policy dataset unbind policy dataset show policy dataset
rm policy dataset
Synopsis rm policy dataset <name>
Description Remove the set created by the add set command. Arguments name The name of the set. The name must not exceed 127 characters. Example rm policy dataset pat1
Related Commands add policy dataset bind policy dataset unbind policy dataset show policy dataset
bind policy dataset

Synopsis bind policy dataset <name> [<value>] [-index <positive_integer>] Description Bind a value (ipv4, ipv6, number) to a dataset. If first value is bound using index label then next bind statements to that set should provide index, and vice versa Arguments name The name of the set. The name must not exceed 127 characters. value The value (ipv4, ipv6, number) associated with the set. Example bind policy dataset ts1 192.168.20.1 -index 2
Related Commands add policy dataset rm policy dataset unbind policy dataset show policy dataset
unbind policy dataset

Synopsis unbind policy dataset <name> <value>
Description Unbind string(s) from a set. Arguments name The name of the set. The name must not exceed 127 characters. value The value (ipv4, ipv6, number) associated with the set. Example unbind policy dataset pat1 bar xyz
Related Commands add policy dataset rm policy dataset bind policy dataset show policy dataset
show policy dataset

Synopsis show policy dataset [<name>] Description Display the configured dataset(s). Arguments name The name of the set. The name must not exceed 127 characters. summary fullValues format level stateflag value The value (ipv4, ipv6, number) associated with the set. index The index of the value (ipv4, ipv6, number) associated with the set. description Description of the set type The type of set: ipv4, ipv6, number IndexType
Index type. count Example show policy dataset set1
Related Commands add policy dataset rm policy dataset bind policy dataset unbind policy dataset
add policy httpCallout

Synopsis add policy httpCallout <name> Description Add a httpcallout. Each httpcallout is identified by a name. Arguments name The name of the httpcallout. The name must not exceed 31 characters. Example add policy httpcallout h1
Related Commands rm policy httpCallout set policy httpCallout unset policy httpCallout show policy httpCallout
rm policy httpCallout
Synopsis rm policy httpCallout <name> Description Removes the httpcallout entity Arguments name The name of the httpcallout.
Example rm policy httpcallout h1 Related Commands add policy httpCallout set policy httpCallout unset policy httpCallout show policy httpCallout
set policy httpCallout

Synopsis set policy httpCallout <name> [-IPAddress <ip_addr|ipv6_addr|*>] [-port <port|*>] [-vServer <string>] [returnType <returnType>] [-httpMethod ( GET | POST )] [-hostExpr <string>] [-urlStemExpr <string>] [-headers <name(value)> ...] [-parameters <name(value)> ...] [-fullReqExpr <string>] [-resultExpr <string>] Description Sets attributes for an httpcallout policy. You invoke this policy by specifying the SYS.HTTP_CALLOUT expression prefix in an advanced expression. Arguments name The name of the httpcallout. IPAddress IPv4 or IPv6 address of the server to which the callout is sent, or a wildcard. Mutually exclusive with the -vserver argument. port If you specify an IP address, this is the port on the server to which the callout is sent, or a wildcard. vServer The name of a load balancing, content switching, or cache redirection virtual server with a service type of HTTP. This is where the callout is sent. This option is mutually exclusive with IP address and port. returnType Type of data that the target application returns in the response to the callout. Possible values: BOOL, NUM, TEXT httpMethod Method used in the HTTP request that this callout sends. Mutually exclusive with -fullReqExpr. Possible values: GET, POST hostExpr Advanced text expression to configure the Host header. The expression can contain a literal value (10.101.10.11) or a derived value (for example, http.req.header. . .). Mutually exclusive with fullReqExpr. urlStemExpr An advanced string expression for generating the URL stem. The expression can contain a literal string (for example, /mysite/index.html) or an expression that derives the value (for example, http.req.url). Mutually exclusive with -fullReqExpr.
headers Advanced text expression to insert HTTP headers and their values in the HTTP callout request. You must specify a value for every header. You specify the header name as a string and the header value as an advanced expression. Mutually exclusive with -fullReqExpr. parameters Advanced expression to insert query parameters in the HTTP request that the callout sends. You must specify a value for every parameter that you configure. If the callout request uses the GET method, these parameters are inserted in the URL. If the callout request uses the POST method, these parameters are inserted in the POST body. You configure the query parameter name as a string, and the value as an advanced expression. The parameter values are URL encoded. Mutually exclusive with -fullReqExpr. fullReqExpr Exact HTTP request that the NetScaler is to send, as an advanced expression of up to 8191 characters. If you specify this parameter, you must omit the httpMethod, hostExpr, urlStemExpr, headers, and parameters arguments. The request expression is constrained by the feature where the callout is used. For example, an HTTP.RES expression cannot be used in a request-time policy bank or in a TCP content switching policy bank. The NetScaler does not check the validity of this request. You must manually validate the request. resultExpr Advanced expression that extracts HTTP.RES objects from the response to the HTTP callout. The maximum length is 8191. The operations in this expression must match the return type. For example, if you configure a return type of TEXT, the result expression must be a text-based expression. If the return type is NUM, the result expression (resultExpr) must return a numeric value, as in the following: http.res.body(10000).length. Example set policy httpcallout h1 -vServer v1
Related Commands add policy httpCallout rm policy httpCallout unset policy httpCallout show policy httpCallout
unset policy httpCallout

Synopsis unset policy httpCallout <name> [-IPAddress] [-port] [-vServer] [-httpMethod] [-hostExpr] [-urlStemExpr] [headers] [-parameters] [-fullReqExpr] [-resultExpr] Description Use this command to remove policy httpCallout settings.Refer to the set policy httpCallout command for meanings of the arguments. Arguments Example
Related Commands add policy httpCallout rm policy httpCallout set policy httpCallout show policy httpCallout
show policy httpCallout

Synopsis show policy httpCallout [<name>] Description Display the configured httpcallout(s). Arguments name The name of the httpcallout. summary fullValues format level stateflag IPAddress Server IP address. port Server port. vServer Vserver name returnType Return type of the http callout httpMethod Http callout request type hostExpr PI string expression for Host urlStemExpr PI string expression for URL stem headers PI string expression for request http headers parameters PI string expression for request query parameters fullReqExpr PI string expression for full http callout request
resultExpr PI string expression for http callout response hits Total hits undefHits Total undefs svrState The state of the service undefReason Reason for last undef recursiveCallout Number of recursive callouts count Example show policy httpcallout h1
Related Commands add policy httpCallout rm policy httpCallout set policy httpCallout unset policy httpCallout
add policy stringmap

Synopsis add policy stringmap <name> [-comment <string>] Description Create a string map. String map consists of key-value pairs. It must contain unique keys. Arguments name The name of the string map that will be created. comment Comments associated with this string map. Example i) add stringmap custom_stringmap . This creates a new string map with name custom_stringmap.
Related Commands rm policy stringmap
set policy stringmap unset policy stringmap bind policy stringmap unbind policy stringmap show policy stringmap
rm policy stringmap
Synopsis rm policy stringmap <name> Description Remove a previously defined string map. String map can only be removed if it is not used in any part of policy, action or expression. Arguments name The name of the string map that will be removed. Example i) rm stringmap custom_stringmap . This removes a string map whose name is custom_stringmap
Related Commands add policy stringmap set policy stringmap unset policy stringmap bind policy stringmap unbind policy stringmap show policy stringmap
set policy stringmap

Synopsis set policy stringmap <name> -comment <string> Description This command modifies a existing string map. Arguments name The name of the string map. comment Comments associated with this string map.
Example i) set stringmap custom_stringmap -comment "custom string map is for URLs." . This updates the comment associated with the string map whose name is custom_stringmap
Related Commands add policy stringmap rm policy stringmap unset policy stringmap bind policy stringmap unbind policy stringmap show policy stringmap
unset policy stringmap

Synopsis unset policy stringmap <name> -comment Description Use this command to remove policy stringmap settings.Refer to the set policy stringmap command for meanings of the arguments. Arguments Example
Related Commands add policy stringmap rm policy stringmap set policy stringmap bind policy stringmap unbind policy stringmap show policy stringmap
bind policy stringmap

Synopsis bind policy stringmap <name> <key> <value> Description Bind key-value to a string map. This adds the key and its associated value in the string map. If the key already exist, and has a different value, old value is over-written with new value.
Arguments name The name of the string map. key The key in the string map. Example bind stringmap custom_stringmap "key-string" "value-string" . This adds the key "key-string" and its associated value "value-string" to the string map whose name is custom_stringmap.
Related Commands add policy stringmap rm policy stringmap set policy stringmap unset policy stringmap unbind policy stringmap show policy stringmap
unbind policy stringmap

Synopsis unbind policy stringmap <name> <key> Description Unbind key from a string map. Removes key from the string map Arguments name The name of the string map. key The key to be removed from the string map. Example unbind stringmap custom_stringmap key1 . This removes the key "key1" and its associated value from the string map whose name is custom_stringmap.
Related Commands add policy stringmap rm policy stringmap set policy stringmap unset policy stringmap bind policy stringmap show policy stringmap
show policy stringmap

Synopsis show policy stringmap [<name>] Description Display the configured string map. It displays all the keys and their corresponding values in the string map. Arguments name The name of the string map, if no name is given then names of all string maps will be displayed. summary fullValues format level stateflag comment Comments associated with this string map. key The key in the string map. value The value associated with the key in the string map. count Example show stringmap custom_stringmap . Displays all the key-value pairs of a string map whose name is custom-stringmap
Related Commands add policy stringmap rm policy stringmap set policy stringmap unset policy stringmap bind policy stringmap unbind policy stringmap
Chapter
30
Pq Commands
Topics: stat pq add pq policy rm pq policy set pq policy unset pq policy show pq policy stat pq policy show pq binding show pq stats
998 | Citrix NetScaler 10 | Pq Commands
stat pq
Synopsis stat pq [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display Priority Queuing statistics. Arguments Policy hits (PolMatch) Number of times the Netscaler appliance matched an incoming request using any priority queuing policy. Threshold failed (ThrsFail) Number of times the Netscaler appliance failed to match an incoming request to any of priority queing policy. Priority 1 requests (Pri1Req) Number of priority 1 requests that the Netscaler appliance received. Priority 2 requests (Pri2Req) Number of priority 2 requests that the Netscaler appliance received. Priority 3 requests (Pri3Req) Number of priority 3 requests that the Netscaler appliance received. Example
Related Commands stat pq policy
add pq policy
Synopsis add pq policy <policyName> -rule <expression> -priority <positive_integer> [-weight <positive_integer>] [-qDepth <positive_integer> | -polqDepth <positive_integer>] Description Add a priority queueing policy. Note: In order to activate priority queuing on a virtual server, this policy needs to be bound to the virtual server using the bindlbvserver command. This virtual server must also have priority queuing turned on using the setvserver CLI command Arguments policyName The name of the priority queuing policy. rule The condition for applying the policy. When requests are received by a system, they are classified into different priority levels based on the expression_logic that they match. Specifies the condition for applying the policy. Expression logic is expression names, separated by the logical operators || and &&, and possibly grouped using parenthesis. If the expression contains blanks (for example,
Citrix NetScaler 10 | Pq Commands | 999
between an expression name and a logical operator), then the entire argument must be enclosed in double quotes. The following are valid expression logic: ns_ext_cgi||ns_ext_asp "ns_non_get && (ns_header_cookie||ns_header_pragma)" When a request comes to the system, it is prioritized based on the expression_list that is matches. priority The priority of queuing the request. When a request matches the configured rule and if server resources are not available, this option specifies a priority for queuing the request until the server resources are available again. Enter the value of positive_integer as 1, 2 or 3. The highest priority level is 1 and the lowest priority value is 3. Minimum value: 1 Maximum value: 3 weight The weight for the priorty level. Each priority level is assigned a weight according to which it is served when server resources are available. The weight for a higher priority request must be set higher than that of a lower priority request. The default weights for the priority queues 1, 2, and 3 are 3, 2, and 1 respectively. Specify the weights as 0 through 101. A weight of 0 indicates that the particular priority level should be served only when there are no requests in any of the priority queues. A weight of 101 specifies a weight of infinity. This means that this priority level is served irrespective of the number of clients waiting in other priority queues. Maximum value: 101 qDepth The queue depth threshold value. When the number of waiting requests in the queue (or queue size) on the virtual server to which this policy is bound, increases to the specified qdepth value, any subsequent requests are dropped to the lowest priority level. Maximum value: 4294967294 polqDepth The policy queue depth threshold value. When the number of waiting requests in all the queue belonging to this policy (or the policy queue size) increases to the specified polqdepth value all subsequent requests are dropped to the lowest priority level. Maximum value: 4294967294 Example
Related Commands bind lb vserver set vserver rm pq policy set pq policy unset pq policy show pq policy stat pq policy
rm pq policy
Synopsis rm pq policy <policyName> ... Description Remove the priority queuing policy that was added using the add pq policy command. Arguments policyName
The name of the priority queuing policy to be removed. Example
Related Commands add pq policy set pq policy unset pq policy show pq policy stat pq policy
set pq policy
Synopsis set pq policy <policyName> [-weight <positive_integer>] [-qDepth <positive_integer> | -polqDepth <positive_integer>] Description Modify priority queuing policies that was set using the add pq policy command. Arguments policyName The name of the priority queuing policy that is to be modified. weight The Weight of priority queuing policy. Maximum value: 101 qDepth Queue Depth of priority queuing policy. Maximum value: 4294967294 polqDepth Policy Queue Depth of priority queuing policy. Maximum value: 4294967294 Example
Related Commands add pq policy rm pq policy unset pq policy show pq policy stat pq policy
unset pq policy
Synopsis unset pq policy <policyName> [-weight] [-qDepth] [-polqDepth]
Description Use this command to remove pq policy settings.Refer to the set pq policy command for meanings of the arguments. Arguments Example
Related Commands add pq policy rm pq policy set pq policy show pq policy stat pq policy
show pq policy
Synopsis show pq policy [<policyName>] Description Display all priority queuing policies added using the add pq policy command. Arguments policyName Policy Name summary fullValues format level stateflag rule The condition for applying the policy. priority The priority of queuing the request. weight Weight. qDepth Queue Depth. polqDepth Policy Queue Depth. hits Total number of hits.
count Example
Related Commands add pq policy rm pq policy set pq policy unset pq policy stat pq policy
stat pq policy
Synopsis stat pq policy [<policyName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display Priority Queuing policy statistics. Arguments policyName The name of the PQ policy for which statistics will be displayed. If not given statistics are shown for all PQ policies. count devno stateflag Toatal queue wait time (QWaitTim) Amount of time spent by priority queuing clients waiting in the priority queue. Toatal queue wait time (QWaitTim) Amount of time spent by priority queuing clients waiting in the priority queue. Avg queue wait time (AvWtTime) Average wait time for clients for this priority queuing policy. Avg clt transaction time (AvgTime) Average time taken by a priority queuing client to complete its transaction for this priority queuing policy. Vserver IP (VsIP) IP address of the virtual server to which this priority queuing policy is bound. Vserver port (VsPort) Port number of the virtual server to which this priority queuing policy is bound. Current queue depth (Qdepth) Number of clients waiting currently for this priority queuing policy. Current server connections (ServCons) Current number of server connections established for serving clients for this priority queuing policy.
Server TCP connections (TotServCon) Total number of server connections established for serving clients for this priority queuing policy. Client requests dropped (Dropped) Total number of dropped transactions for this priority queuing policy. Client HTTP transactions (CltTrns) Total number of client transactions for this priority queuing policy. Queue depth (TotQLen) Total number of waiting clients for this priority queuing policy. Avg clt transaction time (us) (AvgTime) Average time taken by a priority queuing client to complete its transaction for this priority queuing policy. Toatal queue wait time (QWaitTim) Amount of time spent by priority queuing clients waiting in the priority queue. Example
Related Commands add pq policy rm pq policy set pq policy unset pq policy show pq policy stat pq
show pq binding
Synopsis show pq binding <vServerName> Description Display binding information for the system's priority queuing feature. This applies to the specified load balancing virtual server (previously bound during priority queuing configuration). Arguments vServerName The load balancing virtual server. summary fullValues stateflag policyName The name of the priority queuing policy. rule The condition for applying the policy.
priority The priority of queuing the request. weight Weight. qDepth Queue Depth. polqDepth Policy Queue Depth. hits Total number of hits. count Example
Related Commands
show pq stats
Synopsis show pq stats - alias for 'stat pq' Description show pq stats is an alias for stat pq Arguments Example
Related Commands stat pq
Chapter
31
Protocol Commands
Topics: stat protocol tcp stat protocol http stat protocol icmp stat protocol ipv6 stat protocol icmpv6 stat protocol ip stat protocol udp set protocol httpBand unset protocol httpBand show protocol httpBand
1006 | Citrix NetScaler 10 | Protocol Commands
stat protocol tcp

Synopsis stat protocol tcp [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display TCP protocol statistics Arguments Server active connections (ActSvrCo) Connections to a server currently responding to requests. Opening server connections (SvrCxO) Server connections in the Opening state, which indicates that the handshakes are not yet complete. Opening client connections (CltCxO) Client connections in the Opening state, which indicates that the handshakes are not yet complete. Established client connections (CltCxE) Current client connections in the Established state, which indicates that data transfer can occur between the NetScaler and the client. Established server connections (SvrCxE) Current server connections in the Established state, which indicates that data transfer can occur between the NetScaler and the server. TCP packets received (TCPPktRx) TCP packets received. TCP bytes received (TCPbRx) Bytes of TCP data received. TCP packets transmitted (TCPPktTx) TCP packets transmitted. TCP bytes transmitted (TCPbTx) Bytes of TCP data transmitted. All client connections (CltCx) Client connections, including connections in the Opening, Established, and Closing state. Closing client connections (CltCxCl) Client connections in the Closing state, which indicates that the connection termination process has initiated but is not complete. Opened client connections (TotCltO) Client connections opened by the NetScaler since startup (after three-way handshake). This counter is reset when the NetScaler is restarted. All server connections (SvrCx) Server connections, including connections in the Opening, Established, and Closing state. Closing server connections (SvrCxCl) Server connections in the Closing state, which indicates that the connection termination process has initiated but is not complete. Opened server connections (TotSvrO) Server connections initiated by the NetScaler since startup. This counter is reset when the NetScaler is restarted. Surge queue (SQlen)
Citrix NetScaler 10 | Protocol Commands | 1007
Connections in the surge queue. When the NetScaler cannot open a connection to the server, for example when maximum connections have been reached, the NetScaler queues these requests. Spare connections (SpConn) Spare connections available. To save time and resources in establishing another connection for a new client, the connection on the server is not closed after completing the request from the first client and is available for serving future requests. Client idle flushed (ZomCltF) Client connections that are flushed because the client has been idle for some time. Client half opened flushed (ZCltFHo) Half-opened client connections that are flushed because the three-way handshakes are not complete. Client active half closed flushed (ZCltFAhc) Active half-closed client connections that are flushed because the client has closed the connection and there has been no activity on the connection. Client passive half closed flushed (ZCltFPhc) Passive half-closed client connections that are flushed because the NetScaler has closed the connection and there has been no activity on the connection. Server idle connections flushed (ZSvrF) Server connections that are flushed because there have been no client requests in the queue for some time. Server half opened flushed (ZSvrFHo) Half-opened server connections that are flushed because the three-way handshakes are not complete. Server active half closed flushed (ZSvrFAhc) Active half-closed server connections that are flushed because the server has closed the connection and there has been no activity on the connection. Server passive half closed flushed (ZSrvFPhc) Passive half-closed server connections that are flushed because the NetScaler has closed the connection and there has been no activity on the connection. Zombie cleanup calls (ZmbCall) Times the Zombie cleanup function is called. Every time a connection is flushed, it is marked for cleanup. The Zombie cleanup function clears all these connections at predefined intervals. SYN packets received (TCPSYN) SYN packets received Server probes (SYNProbe) Probes from the NetScaler to a server. The NetScaler sends a SYN packet to the server to check its availability and expects a SYN_ACK packet from the server before a specified response timeout. FIN packets from server (SvrFin) FIN packets received from the server. FIN packets from client (CltFin) FIN packets received from the clients. Time wait to SYN (WaToSyn) SYN packets (packets used to initiate a TCP connection) received on connections that are in the TIME_WAIT state. Packets cannot be transferred on a connection in this state. Data in TIME_WAIT (WaDat)
Bytes of data received on connections that are in the TIME_WAIT state. Data cannot be transferred on a connection that is in this state. SYN packets held (SYNHeld) SYN packets held on the NetScaler that are waiting for a server connection. SYN packets flushed (SYNFlush) SYN packets flushed on the NetScaler because of no response from the server for three or more seconds. TIME_WAIT connections closed (FinWaitC) Connections closed on the NetScaler because the number of connections in the TIME_WAIT state has exceeded the default value of 7000. Bad TCP checksum (TCPBadCk) Packets received with a TCP checksum error. Data after FIN (TCPDtFin) Packets received following a connection termination request. This error is usually caused by a reordering of packets during transmission. SYN in SYN_RCVD state (TCPSYNRv) SYN packets received on a connection that is in the SYN_RCVD state. A connection goes into the SYN_RCVD state after receiving a SYN packet. SYN in ESTABLISHED state (TCPSYNEs) SYN packets received on a connection that is in the ESTABLISHED state. A SYN packet is not expected on an ESTABLISHED connection. SYN_SENT incorrect ACK packet (TCPBadAk) Incorrect ACK packets received on a connection that is in the SYN_SENT state. An incorrect ACK packet is the third packet in the three-way handshake that has an incorrect sequence number. RST packets received (TCPRST) Reset packets received from a client or a server. RST on not ESTABLISHED (TCPRSTNE) Reset packets received on a connection that is not in the ESTABLISHED state. RST out of window (TCPRSTOW) Reset packets received on a connection that is out of the current TCP window. RST in TIME_WAIT (TCPRSTTi) Reset packets received on a connection that is in the TIME_WAIT state. Packets cannot be transferred on a connection in the TIME_WAIT state. Server out of order packets (SvrOOO) Out of order TCP packets received from a server. Client out of order packets (CltOOO) Out of order TCP packets received from a client. TCP hole on client connection (CltHole) TCP holes created on a client connection. When out of order packets are received from a client, a hole is created on the NetScaler for each group of missing packets. TCP hole on server connection (SvrHole) TCP holes created on a server connection. When out of order packets are received from a server, a hole is created on the NetScaler for each group of missing packets. Seq number SYN cookie reject (CSeqRej) SYN cookie packets rejected because they contain an incorrect sequence number.
Signature SYN cookie reject (CSigRej) SYN cookie packets rejected because they contain an incorrect signature. Seq number SYN cookie drop (CSigDrp) SYN cookie packets dropped because the sequence number specified in the packets is outside the current window. MSS SYN cookie reject (CMssRej) SYN cookie packets rejected because the maximum segment size (MSS) specified in the packets is incorrect. Any IP port allocation failure (PortFal) Port allocations that have failed on a mapped IP address because the maximum limit of 65536 has been exceeded. IP port allocation failure (PortFalI) Port allocations that have failed on a subnet IP address or vserver IP address because the maximum limit of 65536 has been exceeded. Stray packets (StrayPkt) Number of stray or misrouted packets. RST packets sent (SentRst) Reset packets sent to a client or a server. Bad state connections (BadConn) Connections that are not in a valid TCP state. RST threshold dropped (RstThre) Reset packets dropped because the default threshold of 100 resets per 10 milliseconds has been exceeded. This is a configurable value using the set rateControl command. Packets out of window (OOWPkt) Packets received that are out of the current advertised window. SYNs dropped (Congestion) (SynCng) SYN packets dropped because of network congestion. Client retransmissions (TCPCltRe) Packets retransmitted by a client. This usually occurs because the acknowledgement from the NetScaler has not reached the client. Full packet retransmissions (TCPFulRe) Full packets retransmitted by the client or the server. SYN packet retries (TCPSYNRe) SYN packets resent to a server. SYN packets timeout (TCPSYNG) Attempts to establish a connection on the NetScaler that timed out. TCP retransmission (Retr) TCP packets retransmitted. The NetScaler attempts to retransmit the packet up to seven times, after which it resets the other half of the TCP connection. 1st retransmission (1stRetr) Packets retransmitted once by the NetScaler. 3rd retransmission (3rdRetr) Packets retransmitted three times by the NetScaler. 5th retransmission (5thRetr)
Packets retransmitted five times by the NetScaler. 7th retransmission (7thRetr) Packets retransmitted seven times by the NetScaler. If this fails, the NetScaler terminates the connection. Fast retransmits (FastRetr) TCP packets on which the NetScaler performs a fast retransmission in response to three duplicate acknowledgements or a partial acknowledgement. The NetScaler assumes that the packet is lost and retransmits the packet before its time-out. Server retransmissions (TCPSvrRe) Packets retransmitted by a server. This usually occurs because the acknowledgement from the NetScaler has not reached the server. Partial packet retransmissions (TCPParRe) Partial packet retransmits by a client or server due to congestion on the connection. This usually occurs because the window advertised by the NetScaler is not big enough to hold the full packet. FIN packet retries (TCPFINRe) FIN packets resent to a server or a client. FIN packets timeout (TCPFING) Connections that were timed out by the NetScaler because of not receiving the ACK packet after retransmitting the FIN packet four times. 2nd retransmission (2ndRetr) Packets retransmitted twice by the NetScaler. 4th retransmission (4thRetr) Packets retransmitted four times by the NetScaler. 6th retransmission (6thRetr) Packets retransmitted six times by the NetScaler. TCP retransmission giveup (RetrG) Number of times NetScaler terminates a connection after retransmitting the packet seven times on that connection.Retrasnmission happens when recieving end doesn't acknowledges the packet. TCP level cip failure (CltHdrEr) Number of times TCP level client header insertion failure Example
Related Commands stat protocol http stat protocol icmp stat protocol ipv6 stat protocol icmpv6 stat protocol udp
stat protocol http

Synopsis stat protocol http [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>]
Description Display HTTP protocol statistics Arguments Total requests (HTReqRx) Total number of HTTP requests received. Total responses (HTRspRx) Total number of HTTP responses sent. Request bytes received (HTReqbRx) Total number of bytes of HTTP request data received. Response bytes received (HTRspbRx) Total number of bytes of HTTP response data received. GETs (HTGETs) Total number of HTTP requests received with the GET method. POSTs (HTPOSTs) Total number of HTTP requests received with the POST method. Other methods (HTOthers) Total number of HTTP requests received with methods other than GET and POST. Some of the other well-defined HTTP methods are HEAD, PUT, DELETE, OPTIONS, and TRACE. Userdefined methods are also allowed. HTTP/1.0 requests (HT10ReqRx) Total number of HTTP/1.0 requests received. HTTP/1.1 requests (HT11ReqRx) Total number of HTTP/1.1 requests received. Content-length requests (HTCLnReq) Total number of HTTP requests in which the Content-length field of the HTTP header has been set. Content-length specifies the length of the content, in bytes, in the associated HTTP body. Chunked requests (HTChkReq) Total number of HTTP requests in which the Transfer-Encoding field of the HTTP header has been set to chunked. Request bytes transmitted (HTReqbTx) Total number of bytes of HTTP request data transmitted. HTTP/1.0 responses (HT10RspRx) Total number of HTTP/1.0 responses sent. HTTP/1.1 responses (HT11RspRx) Total number of HTTP/1.1 responses sent. Content-length responses (HTCLnRsp) Total number of HTTP responses sent in which the Content-length field of the HTTP header has been set. Content-length specifies the length of the content, in bytes, in the associated HTTP body. Chunked responses (HTChunk) Total number of HTTP responses sent in which the Transfer-Encoding field of the HTTP header has been set to chunked. This setting is used when the server wants to start sending the response before knowing its total length. The server breaks the response into chunks and sends them in sequence, inserting the length of each chunk before the actual data. The message ends with a chunk of size zero. Multi-part responses (HTMPrtHd)
Total number of HTTP multi-part responses sent. In multi-part responses, one or more entities are encapsulated within the body of a single message. FIN-terminated responses (HTNoCLnChunk) Total number of FIN-terminated responses sent. In FIN-terminated responses, the server finishes sending the data and closes the connection. Response bytes transmitted (HTRspbTx) Total number of bytes of HTTP response data transmitted. Incomplete headers (HTIncHd) Total number of HTTP requests and responses received in which the HTTP header spans more than one packet. Incomplete request headers (HTIncReqHd) Total number of HTTP requests received in which the header spans more than one packet. Incomplete response headers (HTIncRspHd) Total number of HTTP responses received in which the header spans more than one packet. HTTP 500 Server-busy Responses (HT500Rsp) Total number of HTTP error responses received. Some of the error responses are: 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout 505 HTTP Version Not Supported Large/Invalid messages (HTInvReq) Total number of requests and responses received with large body. Large/Invalid chunk requests (HTInvChkRx) Total number of requests received with large chunk size, in which the Transfer-Encoding field of the HTTP header has been set to chunked. Large/Invalid content-length (HTInvCLn) Total number of requests received with large content, in which the Content-length field of the HTTP header has been set. Content-length specifies the length of the content, in bytes, in the associated HTTP body. Example Related Commands stat protocol tcp stat protocol icmp stat protocol ipv6 stat protocol icmpv6 stat protocol udp
stat protocol icmp

Synopsis stat protocol icmp [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display ICMP protocol statistics Arguments ICMP packets received (ICPktRx) ICMP packets received.
ICMP bytes received (ICbRx) Bytes of ICMP data received. ICMP packets transmitted (ICPktTx) ICMP packets transmitted. ICMP bytes transmitted (ICbTx) Bytes of ICMP data transmitted. ICMP echo replies received (ECORepRx) ICMP Ping echo replies received. ICMP echo replies transmitted (ECORepTx) ICMP Ping echo replies transmitted. ICMP echos received (ECORx) ICMP Ping Echo Request and Echo Reply packets received. MTU lookup on dst ip info recvd (MTULkDst) Total number of MTU lookup on destination IP info received on a need fragmentation ICMP error message failed. ICMP rate threshold (pkts/sec) (ICThs) Limit for ICMP packets handled every 10 milliseconds. Default value, 0, applies no limit. This is a configurable value using the set rateControl command. ICMP port unreachable received (PortUnRx) ICMP Port Unreachable error messages received. This error is generated when there is no service is running on the port. ICMP port unreachable generated (PortUnTx) ICMP Port Unreachable error messages generated. This error is generated when there is no service is running on the port. Need fragmentation received (NeedFrag) ICMP Fragmentation Needed error messages received for packets that need to be fragmented but for which Don't Fragment is specified the header. ICMP rate threshold exceeded (ICRtEx) Times the ICMP rate threshold is exceeded. If this counter continuously increases, first make sure the ICMP packets received are genuine. If they are, increase the current rate threshold. ICMP packets dropped (ICPktDr) ICMP packets dropped because the rate threshold has been exceeded. Bad ICMP checksum (BadCkSum) ICMP Fragmentation Needed error messages received with an ICMP checksum error. PMTU non-first IP fragments (PMTUerr) ICMP Fragmentation Needed error messages received that were generated by an IP fragment other than the first one. PMTU Invalid body len received (IvBdyLen) ICMP Fragmentation Needed error messages received that specified an invalid body length. PMTU no tcp connection (NoTcpCon) ICMP Need Fragmentation error messages received for TCP packets. The state of the connection for these packets is not maintained on the NetScaler. PMTU no udp conection (NoUdpCon)
ICMP Need Fragmentation error messages received for UDP packets. The state of the connection for these packets is not maintained on the NetScaler. PMTU invalid tcp seqno recvd (InvSeqNo) ICMP Fragmentation Needed error messages received for packets that contain an invalid TCP address. Invalid next MTU value recvd (IvNxtMTU) ICMP Fragmentation Needed error messages received in which the Maximum Transmission Unit (MTU) for the next hop is out of range. The range for the MTU is 576-1500. Next MTU > Current MTU (BigNxMTU) ICMP Fragmentation Needed error messages received in which the value for the next MTU is higher than that of the current MTU. PMTU Invalid protocol recvd (IvPrtRx) ICMP Fragmentation Needed error messages received that contain a protocol other than TCP and UDP. PMTU IP check sum error (CkSumErr) ICMP Fragmentation Needed error messages received with an IP checksum error. PMTU pcb with no link (NoLnkErr) ICMP Fragmentation Needed error messages received on a Protocol Control Block (PCB) with no link. The PCB maintains the state of the connection. PMTU Discovery not enabled (PMTUdis) ICMP Need Fragmentation error messages received when the PMTU Discovery mode is not enabled. Example Related Commands stat protocol tcp stat protocol http stat protocol ipv6 stat protocol icmpv6 stat protocol udp
stat protocol ipv6

Synopsis stat protocol ipv6 [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display ipv6 protocol statistics Arguments IPv6 packets received (ipv6RxPkts) IPv6 packets received. IPv6 bytes received (ipv6RxBytes) Bytes of IPv6 data received. IPv6 packets transmitted (ipv6TxPkts) IPv6 packets transmitted
IPv6 bytes transmitted (ipv6TxBytes) Bytes of IPv6 data transmitted. Total Routed IPv6 packets (ipv6RoutePkts) IPv6 packets routed. Total Routed IPv6 Mbits (ipv6RouteMbits) IPv6 total Mbits. IPv6 Fragments received. (ipv6FragRxPkts) IPv6 fragments received. TCP Fragments reassembled. (ipv6FragTcpReass) TCP fragments processed after reassembly. UDP Fragments reassembled. (ipv6FragUdpReass) UDP fragments processed after reassembly. IPv6 Fragments processed without reassembly. (ipv6FragPktsProcessNoReass) IPv6 fragments processed without reassembly. IPv6 Fragments bridged. (ipv6FragPktsForward) IPv6 fragments forwarded to the client or server without reassembly. IPv6 error hdr packets (RxErrHdr) Packets received that contain an error in one or more components of the IPv6 header. IPv6 unsupported next header (Errnxthdr) Packets received that contain an unsupported next header. The supported next headers are TCP, ICMP, UDP, OSPF, and FRAGMENT. IPv6 Land-attacks (land attack) Land-attack packets received. The source and destination addresses are the same. If not dropped, these packets can lock up the appliance. Reassembled data too big (AssembledPktTooBig) Packets received for which the reassembled data exceeds the Ethernet packet data length of 1500 bytes. Zero fragment length received (ZeroLenFramentedPkt) Packets received with a fragment length of 0 bytes. ICMPv6 NA packets received Number of ICMPv6 NA packets received by NetScaler (OBSOLETE). ICMPv6 NS packets received Number of ICMPv6 NS packets received by NetScaler (OBSOLETE). ICMPv6 NA packets transmitted Number of ICMPv6 NA packets transmitted by NetScaler (OBSOLETE). ICMPv6 NS packets transmitted Number of ICMPv6 NS packets transmitted by NetScaler (OBSOLETE). ICMPv6 RA packets received Number of ICMPv6 RA packets received by NetScaler (OBSOLETE). ICMPv6 RS packets transmitted Number of ICMPv6 RS packets transmitted by NetScaler (OBSOLETE). ICMPv6 packets received Number of ICMPv6 packets received by NetScaler (OBSOLETE).
ICMPv6 packets transmitted Number of ICMPv6 packets transmitted by NetScaler (OBSOLETE). IPv6 error hdr packets Number of erroneous header packets received (OBSOLETE). IPv6 error packets Number of erroneous packets received (OBSOLETE). IPv6 bad checksum Number of bad checksum packets received (OBSOLETE). ICMPv6 error packets Number of erroneous ICMPv6 packets received (OBSOLETE). unsupported ICMPv6 packets Number of ICMPv6 unsupported packets received (OBSOLETE). Rate threshold exceeded packets Number of ICMPv6 packets dropped for rate threshold exceeded (OBSOLETE). Example Related Commands stat protocol tcp stat protocol http stat protocol icmp stat protocol icmpv6 stat protocol ip stat protocol udp
stat protocol icmpv6

Synopsis stat protocol icmpv6 [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display icmpv6 protocol statistics Arguments ICMPv6 packets received (icmpv6RxPkts) ICMPv6 packets received. ICMPv6 bytes received (icmpv6RxBytes) Bytes of ICMPv6 data received. ICMPv6 packets transmitted (icmpv6TxPkts) ICMPv6 packets transmitted. ICMPv6 bytes transmitted (icmpv6TxBytes) Bytes of ICMPv6 data transmitted. ICMPv6 NA packets received (icmpv6RxNa) ICMPv6 neighbor advertisement packets received. These packets are received in response to a neighbor solicitation message sent out by this node, or if the link layer address of a neighbor has changed.
ICMPv6 NS packets received (icmpv6RxNs) ICMPv6 neighbor solicitation packets received. These packets are received if the link layer address of a neighbor has changed, or in response to a neighbor solicitation message sent out by this node. ICMPv6 RA packets received (icmpv6RxRa) ICMPv6 router advertisement packets received. These are received at defined intervals or in response to a router solicitation message. ICMPv6 RS packets received (icmpv6RxRs) ICMPv6 router solicitation packets received. These could be sent by a neighboring router to initiate address resolution. ICMPv6 Echo Request packets received (icmpv6RxEchoReq) ICMPv6 Ping Echo Request packets received. ICMPv6 Echo Reply packets received (icmpv6RxEchoReply) ICMPv6 Ping Echo Reply packets received. ICMPv6 NA packets transmitted (icmpv6TxNa) ICMPv6 neighbor advertisement packets transmitted. These packets are sent in response to a neighbor solicitation packet, or if the link layer address of this node has changed. ICMPv6 NS packets transmitted (icmpv6TxNs) ICMPv6 neighbor solicitation packets transmitted. These packets are sent to get the link layer addresses of neighboring nodes or to confirm that they are reachable. ICMPv6 RA packets transmitted (icmpv6TxRa) ICMPv6 router advertisement packets transmitted. These packets are sent at regular intervals or in response to a router solicitation packet from a neighbor. ICMPv6 RS packets transmitted (icmpv6TxRs) ICMPv6 router solicitation packets transmitted. These packets are sent to request neighboring routers to generate router advertisements immediately rather than wait for the next defined time. ICMPv6 Echo Request packets transmitted (icmpv6TxEchoReq) ICMPv6 Ping Echo Request packets transmitted. ICMPv6 Echo Reply packets transmitted (icmpv6TxEchoReply) ICMP Ping Echo Reply packets transmitted. ICMPv6 RA error packets (Error in RA packet) ICMPv6 router advertisement error packets received that contain an error in the header, such as an incorrect source IP address, destination IP address, or packet length. ICMPv6 NA error packets (Error in NA packet) ICMPv6 neighbor advertisement error packets received that contain an error in the header, such as an incorrect source IP address, destination IP address, or packet length. ICMPv6 NS error packets (Error in NS packet) ICMPv6 neighbor solicitation error packets received that contain an error in the header, such as an incorrect source IP address, destination IP address, or packet length. ICMPv6 bad checksum (Cksumerr) Packets received with an ICMPv6 checksum error. unsupported ICMPv6 packets (icmpv6Unspt) ICMPv6 packets received that are not supported by the NetScaler. Rate threshold exceeded packets (icmpv6thsld) Packets dropped because the default threshold of 100 requests per 10 milliseconds has been exceeded. This is a configurable value using the set rateControl command.
Example Related Commands stat protocol tcp stat protocol http stat protocol icmp stat protocol ipv6 stat protocol udp
stat protocol ip
Synopsis stat protocol ip [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display IP protocol statistics Arguments IP packets received (IPPktRx) IP packets received. IP bytes received (IPbRx) Bytes of IP data received. IP packets transmitted (IPPktTx) IP packets transmitted. IP bytes transmitted (IPbTx) Bytes of IP data transmitted. Megabits received (IPMbRx) Megabits of IP data received. Megabits transmitted (IPMbTx) Megabits of IP data transmitted. Total routed IP packets (IPRoutedPkts) Total routed packets. Total routed IP Mbits (IPRoutedMbits) Total routed Mbits IP fragments received (IPFragRx) IP fragments received. Successful reassembly (reasSucc) Fragmented IP packets successfully reassembled on the NetScaler. Reassembly attempted (reasAtmp) IP packets that the NetScaler attempts to reassemble. If one of the fragments is missing, the whole packet is dropped. IP address lookups (IpLkUp) IP address lookups performed by the NetScaler. When a packet is received on a non-established session, the NetScaler checks if the destination IP address is one of the NetScaler owned IP addresses. IP address lookup failure (IpLkFail)
IP address lookups performed by the NetScaler that have failed because the destination IP address of the packet does not match any of the NetScaler owned IP addresses. UDP fragments forwarded (udpFgFwd) UDP fragments forwarded to the client or the server. TCP fragments forwarded (tcpFgFwd) TCP fragments forwarded to the client or the server. Fragmentation packets created (frgPktCr) Fragmented packets created by the NetScaler. Bad IP checksums (badCksum) Packets received with an IP checksum error. Unsuccessful reassembly (reasFail) Packets received that could not be reassembled. This can occur when there is a checksum failure, an identification field mismatch, or when one of the fragments is missing. Reassembled data too big (reasBig) Packets received for which the reassembled data exceeds the Ethernet packet data length of 1500 bytes. Zero fragment length received (zeroLen) Packets received with a fragment length of 0 bytes. Duplicate fragments received (dupFrag) Duplicate IP fragments received. This can occur when the acknowledgement was not received within the expected time. Out of order fragment received (oooFrag) Fragments received that are out of order. Unknown destination received (UnkDst) Packets received in which the destination IP address was not reachable or not owned by the NetScaler. Bad Transport (badTran) Packets received in which the protocol specified in the IP header is unknown to the NetScaler. VIP down (vipDown) Packets received for which the VIP is down. This can occur when all the services bound to the VIP are down or the VIP is manually disabled. Fix header failure (hdrFail) Packets received that contain an error in one or more components of the IP header. TTL expired during transit (ttlExp) Packets for which the time-to-live (TTL) expired during transit. These packets are dropped. max non-TCP clients (maxClt) Attempts to open a new connection to a service for which the maximum limit has been exceeded. Default value, 0, applies no limit. Unknown services (UnkSvc) Packets received on a port or service that is not configured. land-attacks (LndAtk) Land-attack packets received. The source and destination addresses are the same. Invalid IP header size (errHdrSz)
Packets received in which an invalid data length is specified, or the value in the length field and the actual data length do not match. The range for the Ethernet packet data length is 0-1500 bytes. Invalid IP packet size (errPktLen) Total number of packets received by NetScaler with invalid IP packet size. Truncated IP packet (trIP) Truncated IP packets received. An overflow in the routers along the path can truncate IP packets. Truncated non-IP packet (trNonIp) Truncated non-IP packets received. ZERO next hop (zrNxtHop) Packets received that contain a 0 value in the next hop field. These packets are dropped. Packets with len > 1514 rcvd (BadLenTx) Packets received with a length greater than the normal maximum transmission unit of 1514 bytes. Packets with bad MAC sent (BadMacTx) IP packets transmitted with a bad MAC address. Example
Related Commands stat protocol tcp stat protocol http stat protocol icmp stat protocol ipv6 stat protocol icmpv6 stat protocol udp
stat protocol udp

Synopsis stat protocol udp [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display UDP protocol statistics Arguments Packets received (UDPPktRx) Total number of UDP packets received. Bytes received (UDPbRx) Total number of UDP data received in bytes. Packets transmitted (UDPPktTx) Total number of UDP packets transmitted. Bytes transmitted (UDPbTx) Total number of UDP data transmitted in bytes. Current rate threshold (UDPThs)
Limit for UDP packets handled every 10 milliseconds. Default value, 0, applies no limit. This is a configurable value using the set rateControl command. Unknown service (UDPUnSvc) Stray UDP packets dropped due to no configured listening service. Bad UDP checksum (UDPBadCkSum) Packets received with a UDP checksum error. Rate threshold exceeded (UDPRtEx) Number of times the UDP rate threshold is exceeded. If this counter continuously increases, first make sure the UDP packets received are genuine. If they are, increase the current rate threshold. This is a configurable value using the set rateControl command. Example
Related Commands stat protocol tcp stat protocol http stat protocol icmp stat protocol ipv6 stat protocol icmpv6
set protocol httpBand

Synopsis set protocol httpBand [-reqBandSize <integer>] [-respBandSize <integer>] Description Set band size for HTTP request/response band statistics. Arguments reqBandSize Band size for HTTP request band statistics. Default value: 100 Minimum value: 50 respBandSize Band size for HTTP response band statistics. Default value: 1024 Minimum value: 50 Example set protocol httpBand -reqBandSize 200 -respBandSize 2048 Related Commands unset protocol httpBand show protocol httpBand
unset protocol httpBand

Synopsis unset protocol httpBand [-reqBandSize] [-respBandSize]
Description Use this command to remove protocol httpBand settings.Refer to the set protocol httpBand command for meanings of the arguments. Arguments Example
Related Commands set protocol httpBand show protocol httpBand
show protocol httpBand

Synopsis show protocol httpBand -type ( REQUEST | RESPONSE ) Description Display HTTP request/response band statistics. Arguments type Specify whether to display request/response band statistics. Possible values: REQUEST, RESPONSE format level BandRange The range of the HTTP request/response size, in bytes. TotalBandSize The total size of all HTTP requests/responses in this size range. AvgBandSize The average size of all HTTP requests/responses in this size range. BandData The total size of all HTTP requests/responses in this size range, expressed as a percentage of the total size of all HTTP requests/responses. AccessCount The number of HTTP requests/responses in this size range. AccessRatio The number of HTTP requests/responses in this size range, expressed as a percentage of the total number of HTTP requests/responses. Example
Related Commands set protocol httpBand
unset protocol httpBand
Chapter
32
Responder Commands
Topics: add responder policy rm responder policy set responder policy unset responder policy show responder policy rename responder policy stat responder policy add responder action rm responder action set responder action unset responder action show responder action rename responder action add responder policylabel rm responder policylabel bind responder policylabel unbind responder policylabel show responder policylabel stat responder policylabel rename responder policylabel bind responder global unbind responder global show responder global set responder param unset responder param show responder param import responder htmlpage rm responder htmlpage update responder htmlpage show responder htmlpage
1026 | Citrix NetScaler 10 | Responder Commands
add responder policy

Synopsis add responder policy <name> <rule> <action> [<undefAction>] [-comment <string>] [-logAction <string>] [appflowAction <string>] Description Add a responder policy. Arguments name Name of the responder policy rule Expression to be used by responder policy. It has to be a boolean PI rule expression. action Responder action to be used by the policy. undefAction Responder action to be taken in the case of UNDEF event during policy evaluation. Should be NOOP, RESET or DROP. comment Comments associated with this responder policy. logAction The log action associated with the responder policy appflowAction The appflow action associated with the ES4NS responder policy Example i) add responder policy pol9 "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh3\\")" act_respondwith Related Commands rm responder policy set responder policy unset responder policy show responder policy rename responder policy stat responder policy
rm responder policy
Synopsis rm responder policy <name> Description Remove a responder policy.
Citrix NetScaler 10 | Responder Commands | 1027
Arguments name Name of the responder policy to be removed. Example rm responder policy pol9 Related Commands add responder policy set responder policy unset responder policy show responder policy rename responder policy stat responder policy
set responder policy

Synopsis set responder policy <name> [-rule <expression>] [-action <string>] [-undefAction <string>] [-comment <string>] [logAction <string>] [-appflowAction <string>] Description Set a new rule/action for existing unbound responder policy. Arguments name Name of the responder policy rule Expression to be used by responder policy. It has to be a boolean PI rule expression. action Responder action to be used by the policy. undefAction Responder action to be taken in the case of UNDEF event during policy evaluation. Should be NOOP, RESET or DROP. comment Comments associated with this responder policy. logAction The log action associated with the responder policy appflowAction The appflow action associated with the ES4NS responder policy Example set responder policy pol9 -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh2\\")" Related Commands add responder policy
rm responder policy unset responder policy show responder policy rename responder policy stat responder policy
unset responder policy

Synopsis unset responder policy <name> [-undefAction] [-comment] [-logAction] [-appflowAction] Description Unset undefAction for existing responder policy..Refer to the set responder policy command for meanings of the arguments. Arguments Example unset responder policy respol9 -undefAction Related Commands add responder policy rm responder policy set responder policy show responder policy rename responder policy stat responder policy
show responder policy

Synopsis show responder policy [<name>] show responder policy stats - alias for 'stat responder policy' Description Display all the configured responder policies. Arguments name Name of the responder policy. summary fullValues format level stateflag
rule Rule of the policy. action Responder action associated with the policy. undefAction UNDEF action associated with the policy. hits Number of hits. undefHits Number of policy UNDEF hits. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. comment Comments associated with this responder policy. logAction The log action associated with the responder policy bindPolicyType vserverType appflowAction The appflow action associated with the ES4NS responder policy count Example show responder policy Related Commands add responder policy rm responder policy set responder policy unset responder policy rename responder policy
stat responder policy
rename responder policy

Synopsis rename responder policy <name>@ <newName>@ Description Rename a responder policy. Arguments name The name of the responder policy. newName The new name of the responder policy. Example rename responder policy oldname newname
Related Commands add responder policy rm responder policy set responder policy unset responder policy show responder policy stat responder policy
stat responder policy

Synopsis stat responder policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display responder policy statistics. Arguments name The name of the responder policy for which statistics will be displayed. If not given statistics are shown for all responder policies. count devno stateflag Policy hits (Hits)
Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example
Related Commands add responder policy rm responder policy set responder policy unset responder policy show responder policy rename responder policy stat responder policylabel
add responder action

Synopsis add responder action <name> <type> (<target> | <htmlpage>) [-bypassSafetyCheck ( YES | NO )] [-comment <string>] Description Creates a responder action. The action thus created can be associated with responder policy by using "add responder policy" command. The system has following built-in action entities: NOOP - the no-op action. RESET - reset the current client and server connection. DROP - drop packets when rate exceeds the rate-limiting threshold Arguments name Name of the responder action to be added. type Type of responder action. It can be: (respondwith|redirect). For each action type the <target> is as defined below. o RESPONDWITH: Send the specified response. <target> = SNIT expression to be sent as the response. <htmlpage> = HTML page to be sent as the response. o REDIRECT: Generates an 'HTTP Redirect' to a specified URL. <target> = where to redirect to. o SQLRESPONSE_OK: Generates an OK response. <target> = Message for SQL OK Packet. o SQLRESPONSE_ERROR: Generates an ERROR response. <target> = Message for SQL ERROR Packet. Possible values: respondwith, redirect, respondwithhtmlpage, sqlresponse_ok, sqlresponse_error target Expression specifying what to respond with. Maximum length of the input expression is 8191 bytes. Maximum size of string that can be used inside the expression is 255 bytes. Multiple string literals can be concatenated using +. For action type SQLRESPONSE_* the maximum length of target string is 511 bytes. htmlpage Name of the html page. htmlpage has to be imported via the 'import responder htmlpage' command. bypassSafetyCheck
Bypass the safety check and allow unsafe expressions Possible values: YES, NO Default value: NO comment Comments associated with this responder action. Example 1) add responder action act1 respondwith "\\"HTTP/1.1 200 OK\\r\\n\\r\\n\\"" 2) add responder action resp respondwithhtmlpage my-responder-page, 3) add responder action redir_action redirect '"http://backupsite2.com" + HTTP.REQ.URL' -bypassSafetyCheck YES
Related Commands rm responder action set responder action unset responder action show responder action rename responder action
rm responder action
Synopsis rm responder action <name> Description Remove a configured responder action. Arguments name Name of the responder action. Example rm responder action act_before
Related Commands add responder action set responder action unset responder action show responder action rename responder action
set responder action

Synopsis set responder action <name> [-target <string> [-bypassSafetyCheck ( YES | NO )]] [-htmlpage <string>] [-comment <string>]
Description Modify a responder action. Arguments name Name of the responder action to be added. target Expression specifying what to respond with. Maximum length of the input expression is 8191 bytes. Maximum size of string that can be used inside the expression is 255 bytes. Multiple string literals can be concatenated using +. For action type SQLRESPONSE_* the maximum length of target string is 511 bytes. htmlpage Name of the html page. htmlpage has to be imported via the 'import responder htmlpage' command. comment Comments associated with this responder action. Example 1. set responder action act_responder -target 'HTTP.REQ.HEADER(MYURL)' bypassSafetyCheck YES/, 2. set responder action act_responder -htmlpage my-local-file
Related Commands add responder action rm responder action unset responder action show responder action rename responder action
unset responder action

Synopsis unset responder action <name> [-htmlpage] [-comment] Description Use this command to remove responder action settings.Refer to the set responder action command for meanings of the arguments. Arguments Example
Related Commands add responder action rm responder action set responder action show responder action
rename responder action
show responder action

Synopsis show responder action [<name>] Description Display configured responder action(s). Arguments name Name of the responder action. summary fullValues format level stateflag type Type of responder action. It can be: (respondwith). target Expression specifying what to to respond with htmlpage Option specifying to respondwith htmlpage bypassSafetyCheck The safety check to allow unsafe expressions. hits The number of times the action has been taken. referenceCount The number of references to the action. undefHits The number of times the action resulted in UNDEF. comment Comments associated with this responder action. count Example 1. show responder action 2. show responder action act_insert
Related Commands add responder action rm responder action
set responder action unset responder action rename responder action
rename responder action

Synopsis rename responder action <name>@ <newName>@ Description Rename a responder action. Arguments name The name of the responder action. newName The new name of the responder action. Example rename responder action oldname newname
Related Commands add responder action rm responder action set responder action unset responder action show responder action
add responder policylabel

Synopsis add responder policylabel <labelName> [-policylabeltype <policylabeltype>] Description Add a responder policy label. Arguments labelName Name of the responder policy label. policylabeltype The type of the policy label. Default value is HTTP Possible values: HTTP, OTHERTCP, SIP_UDP, MYSQL, MSSQL Default value: NS_PLTMAP_RSP_REQ Example add responder policylabel resp_lab
Related Commands rm responder policylabel bind responder policylabel unbind responder policylabel show responder policylabel stat responder policylabel rename responder policylabel
rm responder policylabel
Synopsis rm responder policylabel <labelName> Description Remove a responder policy label. Arguments labelName Name of the responder policy label. Example rm responder policylabel resp_lab Related Commands add responder policylabel bind responder policylabel unbind responder policylabel show responder policylabel stat responder policylabel rename responder policylabel
bind responder policylabel

Synopsis bind responder policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the responder policy to one of the labels. Arguments labelName Name of the responder policy label. policyName Name of the policy to be bound to responder policy label.
Example i) bind responder policylabel resp_lab pol_resp 1 2 ii) bind responder policylabel resp_lab pol_resp 1 2 -invoke vserver CURRENT Related Commands add responder policylabel rm responder policylabel unbind responder policylabel show responder policylabel stat responder policylabel rename responder policylabel
unbind responder policylabel

Synopsis unbind responder policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind entities from responder label. Arguments labelName Name of the responder policy label. policyName The name of the policy to be unbound. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind responder policylabel resp_lab pol_resp Related Commands add responder policylabel rm responder policylabel bind responder policylabel show responder policylabel stat responder policylabel rename responder policylabel
show responder policylabel

Synopsis show responder policylabel [<labelName>]
Description Display policy label or policies bound to responder policylabel. Arguments labelName Name of the responder policy label. summary fullValues format level policylabeltype The type of the policy label. stateflag numpol number of polices bound to label. hits Number of times policy label was invoked. policyName Name of the responder policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flags count Example i) show responder policylabel resp_lab ii) show responder policylabel
Related Commands add responder policylabel rm responder policylabel bind responder policylabel unbind responder policylabel stat responder policylabel rename responder policylabel
stat responder policylabel

Synopsis stat responder policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of responder policylabel(s). Arguments labelName The name of the responder policy label for which statistics will be displayed. If not given statistics are shown for all responder policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add responder policylabel rm responder policylabel bind responder policylabel unbind responder policylabel show responder policylabel rename responder policylabel stat responder policy
rename responder policylabel

Synopsis rename responder policylabel <labelName>@ <newName>@ Description Rename a responder policylabel. Arguments labelName The name of the responder policylabel. newName
The new name of the responder policylabel. Example rename responder policylabel oldname newname
Related Commands add responder policylabel rm responder policylabel bind responder policylabel unbind responder policylabel show responder policylabel stat responder policylabel
bind responder global

Synopsis bind responder global <policyName> <priority> [<gotoPriorityExpression>] [-type <type>] [-invoke (<labelType> <labelName>) ] Description Binds the responder policy with given priority Arguments policyName Name of the policy to be bound to responder global. Example i) bind responder global pol9 9
Related Commands unbind responder global show responder global
unbind responder global

Synopsis unbind responder global <policyName> [-type <type>] [-priority <positive_integer>] Description Unbind entities from responder global. Arguments policyName The name of the policy to be unbound.
priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind responder global pol9
Related Commands bind responder global show responder global
show responder global

Synopsis show responder global [-type <type>] Description Display the responder global bindings. Arguments type The bindpoint to which policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT, OVERRIDE, DEFAULT, OTHERTCP_REQ_OVERRIDE, OTHERTCP_REQ_DEFAULT, SIPUDP_REQ_OVERRIDE, SIPUDP_REQ_DEFAULT, MSSQL_REQ_OVERRIDE, MSSQL_REQ_DEFAULT, MYSQL_REQ_OVERRIDE, MYSQL_REQ_DEFAULT summary fullValues format level stateflag policyName Name of the responder policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType flowtype of the bound responder policy. numpol
number of polices bound to label. flags count Example show responder global
Related Commands bind responder global unbind responder global
set responder param

Synopsis set responder param -undefAction <string> Description Set the default responder undef action. If an UNDEF event is triggered during policy evaluation and if the current policy's undefAction is not specified, then this global undefAction value is used. NOOP is the default value of default responder undef action Arguments undefAction can be NOOP, RESET or DROP Example set responder param -undefAction RESET
Related Commands unset responder param show responder param
unset responder param

Synopsis unset responder param -undefAction Description Unset responder params..Refer to the set responder param command for meanings of the arguments. Arguments Example unset responder param -undefAction
Related Commands set responder param show responder param
show responder param

Synopsis show responder param Description Display default responder undef action. Arguments format level undefAction Name of the responder action. Example show responder param
Related Commands set responder param unset responder param
import responder htmlpage

Synopsis import responder htmlpage [<src>] <name> [-comment <string>] [-overwrite] Description Downloads the input HTML Page to NetScaler Box with the given object name Arguments src name Indicates name of the html page to import/update. comment Comments. overwrite Overwrites the existing file Example import responder htmlpage http://www.example.com/page.html my-responder-page
Related Commands rm responder htmlpage update responder htmlpage show responder htmlpage
rm responder htmlpage
Synopsis rm responder htmlpage <name> Description Removes the object imported by import responder htmlpage. Arguments name Indicates name of the html page to import/update. Example rm responder htmlpage <name>
Related Commands import responder htmlpage update responder htmlpage show responder htmlpage
update responder htmlpage

Synopsis update responder htmlpage <name> Description Reloads the HTML page of the given object name in responder actions Arguments name Indicates name of the html page to import/update. Example update responder htmlpage my-responder-page
Related Commands import responder htmlpage rm responder htmlpage show responder htmlpage
show responder htmlpage

Synopsis show responder htmlpage [<name>] Description Displays the object imported by import responder htmlpage. Arguments name Indicates name of the html page to import/update. response Example show responder htmlpage
Related Commands import responder htmlpage rm responder htmlpage update responder htmlpage
Chapter
33
Rewrite Commands
Topics: add rewrite policy rm rewrite policy set rewrite policy unset rewrite policy show rewrite policy stat rewrite policy rename rewrite policy add rewrite action rm rewrite action set rewrite action unset rewrite action show rewrite action rename rewrite action add rewrite policylabel rm rewrite policylabel bind rewrite policylabel unbind rewrite policylabel show rewrite policylabel stat rewrite policylabel rename rewrite policylabel bind rewrite global unbind rewrite global show rewrite global set rewrite param unset rewrite param show rewrite param
1048 | Citrix NetScaler 10 | Rewrite Commands
add rewrite policy

Synopsis add rewrite policy <name> <rule> <action> [<undefAction>] [-comment <string>] [-logAction <string>] Description Add a rewrite policy. Arguments name Name of the rewrite policy rule Expression to be used by rewrite policy. It has to be a boolean PI rule expression. action Rewrite action to be used by the policy. undefAction A rewrite action, to be used by the policy when the rule evaluation turns out to be undefined. The undef action can be NOREWRITE, RESET or DROP comment Comments associated with this rewrite policy. logAction The log action associated with the rewrite policy Example i) add rewrite policy pol9 "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh3\\")" act_insert ii) add rewrite policy pol9 "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\ \"qh3\\")" act_insert NOREWRITE iii) add rewrite policy pol9 "HTTP.REQ.HEADER(\ \"header\\").CONTAINS(\\"qh3\\")" act_insert RESET iii) add rewrite policy pol9 "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh3\\")" act_insert DROP Related Commands rm rewrite policy set rewrite policy unset rewrite policy show rewrite policy stat rewrite policy rename rewrite policy
rm rewrite policy
Synopsis rm rewrite policy <name> Description Remove a rewrite policy. Arguments name Name of the rewrite policy to be removed.
Citrix NetScaler 10 | Rewrite Commands | 1049
Example rm rewrite policy pol9 Related Commands add rewrite policy set rewrite policy unset rewrite policy show rewrite policy stat rewrite policy rename rewrite policy
set rewrite policy

Synopsis set rewrite policy <name> [-rule <expression>] [-action <string>] [-undefAction <string>] [-comment <string>] [logAction <string>] Description Set a new rule/action/undefAction for existing rewrite policy. The rule flow type can change only if: . action and undefAction(if present) are of NEUTRAL flow type Arguments name Name of the rewrite policy rule Expression to be used by rewrite policy. It has to be a boolean PI rule expression. action Rewrite action to be used by the policy. undefAction A rewrite action, to be used by the policy when the rule evaluation turns out to be undefined. The undef action can be NOREWRITE, RESET or DROP comment Comments associated with this rewrite policy. logAction The log action associated with the rewrite policy Example set rewrite policy pol9 -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh2\\")" Related Commands add rewrite policy rm rewrite policy unset rewrite policy show rewrite policy stat rewrite policy rename rewrite policy
unset rewrite policy

Synopsis unset rewrite policy <name> [-undefAction] [-comment] [-logAction] Description Unset undefAction for existing rewrite policy..Refer to the set rewrite policy command for meanings of the arguments. Arguments Example unset rewrite policy pol9 -undefAction Related Commands add rewrite policy rm rewrite policy set rewrite policy show rewrite policy stat rewrite policy rename rewrite policy
show rewrite policy

Synopsis show rewrite policy [<name>] show rewrite policy stats - alias for 'stat rewrite policy' Description Display all the configured rewrite policies. Arguments name Name of the rewrite policy. summary fullValues format level stateflag rule Expression to be used by rewrite policy. It has to be a boolean PI rule expression. action Rewrite action associated with the policy. undefAction Undef Action associated with the policy. hits Number of hits. undefHits
Number of Undef hits. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policy comment Comments associated with this rewrite policy. logAction The log action associated with the rewrite policy bindPolicyType isDefault A value of true is returned if it is a default rewritepolicy. vserverType count Example show rewrite policy Related Commands add rewrite policy rm rewrite policy set rewrite policy unset rewrite policy stat rewrite policy rename rewrite policy
stat rewrite policy

Synopsis stat rewrite policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display rewrite policy statistics.
Arguments name The name of the rewrite policy for which statistics will be displayed. If not given statistics are shown for all rewrite policies. count devno stateflag Policy hits (Hits) Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example stat rewrite policy Related Commands add rewrite policy rm rewrite policy set rewrite policy unset rewrite policy show rewrite policy rename rewrite policy stat rewrite policylabel
rename rewrite policy

Synopsis rename rewrite policy <name>@ <newName>@ Description Rename a rewrite policy. Arguments name The name of the rewrite policy. newName The new name of the rewrite policy. Example rename rewrite policy oldname newname Related Commands add rewrite policy rm rewrite policy set rewrite policy unset rewrite policy
show rewrite policy stat rewrite policy
add rewrite action

Synopsis add rewrite action <name> <type> <target> [<stringBuilderExpr>] [-pattern <expression> | -search <expression>] [bypassSafetyCheck ( YES | NO )] [-refineSearch <string>] [-comment <string>] Description Creates a rewrite action. The action thus created can be associated with rewrite policy by using "add rewrite policy" command. The system has three built-in action entities: NOREWRITE - no-op action RESET - reset the current client and server connection DROP - drop packets when rate exceeds the rate-limiting threshold A flow type is implicitly associated with every action.Following 3 flow types are possible: 1. Neutral : the action can be request or response time action 2. Request : the action can only be executed at request time 3. Response : the action can only be executed at response time Arguments name Name of the rewrite action to be added. type Type of rewrite action. It can be: (replace|insert_http_header|delete_http_header| corrupt_http_header|insert_before|insert_after|delete|replace_http_res). For each action type the <target> and <string builder expr> are defined below. o INSERT_HTTP_HEADER: Will insert a HTTP header. <target> = header name. <string builder expr> = header value specified as a compound text expression. o INSERT_SIP_HEADER: Will insert a SIP header. <target> = header name. <string builder expr> = header value specified as a compound text expression. o DELETE_HTTP_HEADER: Will delete all occurrence of HTTP header. <target> = header name. o DELETE_SIP_HEADER: Will delete all occurrence of SIP header. <target> = header name. o CORRUPT_HTTP_HEADER: Will corrupt all occurrence of HTTP header. <target> = header name. o CORRUPT_SIP_HEADER: Will corrupt all occurrence of SIP header. <target> = header name. o REPLACE: Will replace the target text reference with the value specified in attr. <target> = Advanced text expression <string builder expr> = Compound text expression o INSERT_BEFORE: Will insert the value specified by attr before the target text reference. <target> = Advanced text expression <string builder expr> = Compound text expression o INSERT_AFTER: Will insert the value specified by attr after the target text reference. <target> = Advanced text expression <string builder expr> = Compound text expression o DELETE: Delete the target text reference. <target> = Advanced text expression o REPLACE_HTTP_RES: Replace the http response with value specified in target. <target> = Compound text expression o REPLACE_SIP_RES: Replace the SIP response with value specified in target. <target> = Compound text expression o REPLACE_ALL: Replaces all occurrence of the pattern in the text provided in the target with the text provided in the stringBuilderExpr, with a string defined in the -pattern argument or -search argument. For example, you can replace all occurences of abcd with -pattern efgh. <target> = text in a request or a response, for example http.req.body(1000) <stringBuilderExpr> = Compound text expression -pattern <expression> = string constant, for example -pattern efgh or -search text("efgh") o INSERT_BEFORE_ALL: Will insert the value specified by stringBuilderExpr before all the occurrence of pattern in the target text reference. <target> = Advanced text expression <stringBuilderExpr> = Compound text expression -pattern <expression> = string constant or advanced regular expression or -search regex(<regular expression>) or -search text(string constant) o INSERT_AFTER_ALL: Will insert the value specified by stringBuilderExpr after all the occurrence of pattern in the target text reference. <target> = Advanced text expression <stringBuilderExpr> = Compound text expression -pattern <expression> = string constant or advanced regular expression or -search regex(<regular expression>) or -search text(string constant) o DELETE_ALL: Delete all the occurrence of pattern in the target text reference. <target> = Advanced text expression -pattern <expression> = string constant or advanced regular expression or -search regex(<regular expression>) or -search text(string constant) Possible values: delete,
insert_http_header, delete_http_header, corrupt_http_header, insert_before, insert_after, replace, replace_http_res, delete_all, replace_all, insert_before_all, insert_after_all, clientless_vpn_encode, clientless_vpn_encode_all, clientless_vpn_decode, clientless_vpn_decode_all, insert_sip_header, delete_sip_header, corrupt_sip_header, replace_sip_res target Expression specifying which part of HTTP packet needs to be rewritten. stringBuilderExpr Expression specifying new value of the rewritten HTTP packet. Maximum length of the input expression is 8191. Maximum size of string that can be used inside the expression is 1499. pattern Pattern to be used for insert_before_all, insert_after_all, replace_all, delete_all action types. search search expression takes the followin 5 argumens to use the appropriate methods to search in the specified body or header: 1. text(string) - example: -search text("hello") 2. regex(re<delimiter>regular exp<delimiter>) - example: -search regex(re/^hello/) 3. xpath(xp<delimiter>xpath expression<delimiter>) - example: -search xpath(xp%/a/b%) 4. xpath_json(xp<delimiter>xpath expression<delimiter>) - example: -search xpath_json(xp%/a/b %) xpath_json_search takes xpath expression as argument but operates on json file instead of xml file. 5. patset(patset) - example: -search patset("patset1") search expression are allowed on actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. search is a super set of pattern. It is advised to use search over pattern. bypassSafetyCheck Bypass the safety check and allow unsafe expressions. Possible values: YES, NO Default value: NO refineSearch refineSearch expressions specifies how the selected HTTP data can further be refined. These expression always starts with the 'Extend(m,n)' operation. Where 'm' specifies number of bytes to the left of selected data and 'n' specifies number of bytes to the right of selected data. refineSearch expression are only allowed on body based expression and for actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. This can accelerate search using regular expression. For example if we need to find all the urls from www.zippo.com in a response body. Rather than writing a regular expression to search this url pattern we can search for 'zippo' pattern first and then extend the search space by some bytes and finally check for prefix 'www.zippo.com'. The rewrite command might look like: add rewrite action act1 delete_all 'http.res.body(10000)' -pattern "zippo" -refineSearch "extend(10,10).regex_select(re%<www.zippo.com[^>].*>%)" Maximum length of the input expression is 8191. Maximum size of string that can be used inside the expression is 1499. comment Comments associated with this rewrite action. Example i) add rewrite action act_insert INSERT_HTTP_HEADER change_req "\\"no change\\"" . This Adds to http header will add the header change_req: no change. ii) add rewrite action act_replace REPLACE "HTTP.REQ.URL.PREFIX(1)" "HTTP.REQ.URL.PREFIX(1)+\\"citrix/\\"" bypassSafetyCheck YES . If HTTP.REQ.URL.PREFIX(1) is / the result would be /citrix/ iii) add rewrite action act_before INSERT_BEFORE "HTTP.REQ.HEADER(\\"host\\").VALUE(0)" "\ \"india\\"" . If HTTP.REQ.HEADER(\\"host\\").VALUE(0) is netscaler.com the result would be indianetscaler.com iv) add rewrite action act_after INSERT_AFTER "HTTP.REQ.HEADER(\ \"host\\").TYPECAST_LIST_T('.').GET(0)" "\\"-india\\"" . If HTTP.REQ.HEADER(\\"host\ \").VALUE(0) is support.netscaler.com then the result would be support-india.netscaler.com v) add rewrite action act_delete DELETE "HTTP.REQ.HEADER(\\"host\\").VALUE(0)" will leave the Host header looking like "HOST: ". vi) add rewrite action act_delete_header
DELETE_HTTP_HEADER Host will delete the Host header. If Host header occurs more than once all occurrence of the header will be deleted. vii) add rewrite action act_corrupt_header CORRUPT_HTTP_HEADER Host will corrupt the Host header. If Host header occurs more than once all occurrence of the header will be corrupted. Related Commands rm rewrite action set rewrite action unset rewrite action show rewrite action rename rewrite action
rm rewrite action
Synopsis rm rewrite action <name> Description Remove a configured rewrite action. Arguments name Name of the rewrite action. Example rm rewrite action act_before Related Commands add rewrite action set rewrite action unset rewrite action show rewrite action rename rewrite action
set rewrite action

Synopsis set rewrite action <name> [-target <string>] [-stringBuilderExpr <string>] [-pattern <expression> | -search <expression>] [-bypassSafetyCheck ( YES | NO )] [-refineSearch <string>] [-comment <string>] Description Modify rewrite action. Arguments name The name of rewrite action to be modified. target Expression specifying which part of the HTTP packet is to be rewritten.
stringBuilderExpr Expression specifying new value of the rewritten HTTP packet. Maximum length of the input expression is 8191. Maximum size of string that can be used inside the expression is 1499. pattern Pattern to be used for insert_before_all, insert_after_all, replace_all, delete_all action types. search search expression takes the followin 5 argumens to use the appropriate methods to search in the specified body or header: 1. text(string) - example: -search text("hello") 2. regex(re<delimiter>regular exp<delimiter>) - example: -search regex(re/^hello/) 3. xpath(xp<delimiter>xpath expression<delimiter>) - example: -search xpath(xp%/a/b%) 4. xpath_json(xp<delimiter>xpath expression<delimiter>) - example: -search xpath_json(xp%/a/b %) xpath_json_search takes xpath expression as argument but operates on json file instead of xml file. 5. patset(patset) - example: -search patset("patset1") search expression are allowed on actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. search is a super set of pattern. It is advised to use search over pattern. bypassSafetyCheck Bypass the safety check and allow unsafe expressions. Possible values: YES, NO Default value: NO refineSearch refineSearch expressions specifies how the selected HTTP data can further be refined. These expression always starts with the 'Extend(m,n)' operation. Where 'm' specifies number of bytes to the left of selected data and 'n' specifies number of bytes to the right of selected data. refineSearch expression are only allowed on body based expression and for actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. This can accelerate search using regular expression. For example if we need to find all the urls from www.zippo.com in a response body. Rather than writing a regular expression to search this url pattern we can search for 'zippo' pattern first and then extend the search space by some bytes and finally check for prefix 'www.zippo.com'. The rewrite command might look like: add rewrite action act1 delete_all 'http.res.body(10000)' -pattern "zippo" -refineSearch "extend(10,10).regex_select(re%<www.zippo.com[^>].*>%)" Maximum length of the input expression is 8191. Maximum size of string that can be used inside the expression is 1499. comment Comments associated with this rewrite action. Example set rewrite action rwact1 -target "HTTP.REQ.HEADER(\\"MyHdr\\")" -stringBuilderExpr "HTTP.REQ.URL.MARK_SAFE" Related Commands add rewrite action rm rewrite action unset rewrite action show rewrite action rename rewrite action
unset rewrite action

Synopsis unset rewrite action <name> [-stringBuilderExpr] [-refineSearch] [-comment]
Description Use this command to remove rewrite action settings.Refer to the set rewrite action command for meanings of the arguments. Arguments Example
Related Commands add rewrite action rm rewrite action set rewrite action show rewrite action rename rewrite action
show rewrite action

Synopsis show rewrite action [<name>] Description Display configured rewrite action(s). Arguments name Name of the rewrite action. summary fullValues format level stateflag type Type of rewrite action. It can be: (delete|replace|insert_http_header|insert_before|insert_after| replace_http_res). target Expression specifying which part of HTTP header needs to be rewritten. stringBuilderExpr Expression specifying the value of rewritten HTTP header. pattern Pattern used for insert_before_all, insert_after_all, replace_all, delete_all action types. search search expression takes the followin 5 argumens to use the appropriate methods to search in the specified body or header: 1. text(string) - example: -search text("hello")
2. regex(re<delimiter>regular exp<delimiter>) - example: -search regex(re/^hello/) 3. xpath(xp<delimiter>xpath expression<delimiter>) - example: -search xpath(xp%/a/b%) 4. xpath_json(xp<delimiter>xpath expression<delimiter>) - example: -search xpath_json(xp%/a/b %) xpath_json_search takes xpath expression as argument but operates on json file instead of xml file. 5. patset(patset) - example: -search patset("patset1") search expression are allowed on actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. search is a super set of pattern. It is advised to use search over pattern. bypassSafetyCheck The safety check to allow unsafe expressions. refineSearch refineSearch expressions specifies how the selected HTTP data can further be refined. These expression always starts with the 'Extend(m,n)' operation. Where 'm' specifies number of bytes to the left of selected data and 'n' specifies number of bytes to the right of selected data. refineSearch expression are only allowed on body based expression and for actions of type 1) replace_all 2) insert_after_all 3) delete_all 4) insert_before_all. This can accelerate search using regular expression. For example if we need to find all the urls from www.zippo.com in a response body. Rather than writing a regular expression to search this url pattern we can search for 'zippo' pattern first and then extend the search space by some bytes and finally check for prefix 'www.zippo.com'. The rewrite command might look like: add rewrite action act1 delete_all 'http.res.body(10000)' -pattern "zippo" -refineSearch "extend(10,10).regex_select(re%<www.zippo.com[^>].*>%)" Maximum length of the input expression is 8191. Maximum size of string that can be used inside the expression is 1499. hits The number of times the action has been taken. undefHits The number of times the action resulted in UNDEF. referenceCount The number of references to the action. description Description of the action flags isDefault A value of true is returned if it is a default rewriteaction. comment Comments associated with this rewrite action. count Example 1. show rewrite action 2. show rewrite action act_insert
Related Commands add rewrite action rm rewrite action set rewrite action unset rewrite action rename rewrite action
rename rewrite action

Synopsis rename rewrite action <name>@ <newName>@ Description Rename a rewrite action. Arguments name The name of the rewrite action. newName The new name of the rewrite action. Example rename rewrite action oldname newname Related Commands add rewrite action rm rewrite action set rewrite action unset rewrite action show rewrite action
add rewrite policylabel

Synopsis add rewrite policylabel <labelName> <transform> Description Add a rewrite policy label. Arguments labelName Name of the rewrite policy label. transform The type of transformations allowed by the policies bound to the label. Possible values: http_req, http_res, othertcp_req, othertcp_res, url, text, clientless_vpn_req, clientless_vpn_res, sipudp_req, sipudp_res Example add rewrite policylabel trans_http_url http_req Related Commands rm rewrite policylabel bind rewrite policylabel
unbind rewrite policylabel show rewrite policylabel stat rewrite policylabel rename rewrite policylabel
rm rewrite policylabel
Synopsis rm rewrite policylabel <labelName> Description Remove a rewrite policy label. Arguments labelName Name of the rewrite policy label. Example rm rewrite policylabel trans_http_url Related Commands add rewrite policylabel bind rewrite policylabel unbind rewrite policylabel show rewrite policylabel stat rewrite policylabel rename rewrite policylabel
bind rewrite policylabel

Synopsis bind rewrite policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the rewrite policy to one of the labels. Arguments labelName Name of the rewrite policy label. policyName The rewrite policy name. Example i) bind rewrite policylabel trans_http_url pol_1 1 2 -invoke reqvserver CURRENT ii) bind rewrite policylabel trans_http_url pol_2 2
Related Commands add rewrite policylabel rm rewrite policylabel unbind rewrite policylabel show rewrite policylabel stat rewrite policylabel rename rewrite policylabel
unbind rewrite policylabel

Synopsis unbind rewrite policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind entities from rewrite label. Arguments labelName Name of the rewrite policy label. policyName The rewrite policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind rewrite policylabel trans_http_url pol_1 Related Commands add rewrite policylabel rm rewrite policylabel bind rewrite policylabel show rewrite policylabel stat rewrite policylabel rename rewrite policylabel
show rewrite policylabel

Synopsis show rewrite policylabel [<labelName>] Description Display policy label or policies bound to rewrite policylabel. Arguments labelName
Name of the rewrite policy label. summary fullValues format level stateflag transform The type of transformations allowed by the policies bound to the label. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The rewrite policy name. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound rewrite policy. description Description of the policylabel isDefault A value of true is returned if it is a default rewritepolicylabel. flags count Example i) show rewrite policylabel trans_http_url ii) show rewrite policylabel Related Commands add rewrite policylabel rm rewrite policylabel bind rewrite policylabel unbind rewrite policylabel stat rewrite policylabel
rename rewrite policylabel
stat rewrite policylabel

Synopsis stat rewrite policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of rewrite policylabel(s). Arguments labelName The name of the rewrite policy label for which statistics will be displayed. If not given statistics are shown for all rewrite policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add rewrite policylabel rm rewrite policylabel bind rewrite policylabel unbind rewrite policylabel show rewrite policylabel rename rewrite policylabel stat rewrite policy
rename rewrite policylabel

Synopsis rename rewrite policylabel <labelName>@ <newName>@ Description Rename a rewrite policy label. Arguments labelName The name of the rewrite policylabel. newName The new name of the rewrite policylabel.
Example rename rewrite policylabel oldname newname
Related Commands add rewrite policylabel rm rewrite policylabel bind rewrite policylabel unbind rewrite policylabel show rewrite policylabel stat rewrite policylabel
bind rewrite global

Synopsis bind rewrite global <policyName> <priority> [<gotoPriorityExpression>] [-type <type>] [-invoke (<labelType> <labelName>) ] Description Bind the rewrite policy to one of the two global lists of rewrite policies. A policy becomes active only after it is bound. All HTTP traffic will be evaluated against these two policy banks. There is a request time policy bank and a response time policy bank. The flow type of the policy implicitly determines which bank it gets bound to. Each bank of policies is an ordered list ordered by policies priority values. Policy Bank Evaluation The goal of evaluation is to traverse the ordered list of policies in the bank, find out which policies match and build a result set that will contain the actions of all the matching policies. While evaluating a policy if any advanced expression cannot be evaluated then UNDEF processing will get triggered. There are also other scenarios during policy traversal when UNDEF processing can get triggered. If an UNDEF event occurs while processing a policy, then (i) policy bank traversal ends, (ii) the result set of actions that was built so far is wiped out (iii) the current policy's undefAction is put in the result set and the evaluation ends. Arguments policyName The rewrite policy name. Example i) bind rewrite global pol9 9 ii) bind rewrite global pol9 9 120 iii) bind rewrite global pol9 9 "HTTP.REQ.HEADER(\\"qh3\\").TYPECAST_NUM_T(DECIMAL)"
Related Commands unbind rewrite global show rewrite global
unbind rewrite global

Synopsis unbind rewrite global <policyName> [-type <type>] [-priority <positive_integer>]
Description Unbind entities from rewrite global. Arguments policyName The rewrite policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind rewrite global pol9
Related Commands bind rewrite global show rewrite global
show rewrite global

Synopsis show rewrite global [-type <type>] Description Display the rewrite global bindings. Arguments type The bindpoint to which to policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT, RES_OVERRIDE, RES_DEFAULT, OTHERTCP_REQ_OVERRIDE, OTHERTCP_REQ_DEFAULT, OTHERTCP_RES_OVERRIDE, OTHERTCP_RES_DEFAULT, SIPUDP_REQ_OVERRIDE, SIPUDP_REQ_DEFAULT, SIPUDP_RES_OVERRIDE, SIPUDP_RES_DEFAULT summary fullValues format level stateflag policyName Name of the rewrite policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation.
labelName Name of the label to invoke if the current policy rule evaluates to TRUE. numpol The number of policies bound to the bindpoint. flowType flowtype of the bound rewrite policy. flags count Example show rewrite global
Related Commands bind rewrite global unbind rewrite global
set rewrite param

Synopsis set rewrite param -undefAction <string> Description Set the default rewrite undef action. If an UNDEF event is triggered during policy evaluation and if the current policy.s undefAction is not specified, then this global undefAction value is used. NOREWRITE is the default value of default rewrite undef action Arguments undefAction can be NOREWRITE, RESET or DROP Example set rewrite param -undefAction RESET
Related Commands unset rewrite param show rewrite param
unset rewrite param

Synopsis unset rewrite param -undefAction Description Unset rewrite params..Refer to the set rewrite param command for meanings of the arguments.
Arguments Example unset rewrite param -undefAction
Related Commands set rewrite param show rewrite param
show rewrite param

Synopsis show rewrite param Description Display default rewrite undef action. Arguments format level undefAction Name of the rewrite action. Example show rewrite param
Related Commands set rewrite param unset rewrite param
Chapter
34
Router Commands
Topics: vtysh add router bgp clear router bgp rm router bgp set router bgp unset router bgp show router bgp set router ospf unset router ospf show router ospf set router rip unset router rip show router rip
1070 | Citrix NetScaler 10 | Router Commands
vtysh
Synopsis vtysh Description Enter this comamand to enter vtysh (the routing shell). Vtysh is the integrated shell of the dynamic routing suite from which all the routing protocols can be configured. Arguments Example
Related Commands
add router bgp

Synopsis Description NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments autonomousSystem The BGP autonomous system. Minimum value: 1 routerID The router ID of the router. learnRoute The state of route learning from BGP. staticRedistribute The state of router in redistribution of static routes. kernelRedistribute The state of router in redistribution of kernel routes. conRedistribute The state of router in redistribution of connected routes. neighbor Add a BGP neighbor. network The neighbor to be advertised. Example
Related Commands clear router bgp
Citrix NetScaler 10 | Router Commands | 1071
rm router bgp set router bgp unset router bgp show router bgp
clear router bgp

Synopsis clear router bgp [<autonomousSystem>] (-neighbor <ip_addr> | -all) Description
Arguments autonomousSystem The autonomous system for BGP. Minimum value: 1 neighbor The neighbor associated with the connection that needs to be torn down. all Reset TCP connections to all neighbors. Example
Related Commands add router bgp rm router bgp set router bgp unset router bgp show router bgp
rm router bgp
Synopsis Description NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments autonomousSystem The autonomous system for BGP. Minimum value: 1 neighbor To remove a particular neighbor. Example
Related Commands add router bgp clear router bgp set router bgp unset router bgp show router bgp
set router bgp

Synopsis Description NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments autonomousSystem The autonomous system for BGP. Minimum value: 1 routerID The Router ID of this router. learnRoute The state of the router in learning routes from BGP. Use this option to enable route learning and installation from BGP. staticRedistribute The state of the router in redistributing static routes. Use this option to enable the redistribution of static routes. kernelRedistribute The state of the router in redistribution of kernel routes. conRedistribute The state of the router in redistributing connected routes. Use this option to enable the redistribution of connected routes into the BGP domain. neighbor The IP address of a BGP peer for the router. network The network to be advertized. Example
Related Commands add router bgp clear router bgp rm router bgp unset router bgp show router bgp
unset router bgp

Synopsis Description Use this command to remove router bgp settings.Refer to the set router bgp command for meanings of the arguments.NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments Example
Related Commands add router bgp clear router bgp rm router bgp set router bgp show router bgp
show router bgp

Synopsis show router bgp [<autonomousSystem>] (<bgpOptions> | -routeMap <string>) Description
Arguments autonomousSystem The autonomous system for BGP. Minimum value: 1 bgpOptions option to show BGP command either neighbors or summary Possible values: neighbors, summary routeMap The BGP route map. summary fullValues format level count stateflag Example
Related Commands add router bgp clear router bgp rm router bgp set router bgp unset router bgp
set router ospf

Synopsis
Description Configure different OSPF parameters. NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments routerID The router ID. passiveInterface The mode of the Interface. Use this option to change the mode of the interface to listen only. staticRedistribute The state of the router in redistributing static routes. Use this option to enable the redistribution of static routes. kernelRedistribute The state of the router in redistributing kernel routes. Use this option to enable the redistribution of kernel routes. conRedistribute The state of the router in redistributing connected routes. Use this option to enable the redistribution of connected routes. learnRoute The state of the router in learning routes from OSPF. Use this option to enable route learning from OSPF. network The broadcast network on which OSPF is to be run. host The stub link. Example set ospf -routerID 1.2.3.4
Related Commands unset router ospf show router ospf
unset router ospf

Synopsis
Description Unset the OSPF parameters that were configured using the ###set ospf### command..Refer to the set router ospf command for meanings of the arguments.NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments Example unset ospf -router-id
Related Commands set router ospf show router ospf
show router ospf

Synopsis
Description Display the state of the OSPF daemon. NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments ospfoptions The Router OSPF option. Use this option to display one of border-routers, database, interface, neighbor, route, and virtual-links. Possible values: border-routers, database, interface, neighbor, route, virtual-links format level network The network on which OSPF is running. netmask Netmask of the network on which OSPF is running Example show ospf neighbor
Related Commands set router ospf
unset router ospf
set router rip

Synopsis
Description Configure the RIP daemon. NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments defaultMetric The default metrics when advertising routes. Default value: 1 Minimum value: 1 Maximum value: 16 passiveInterface The mode of the interface to listen only. learnRoute The state of Route learning. Use this option to enable route learning and installation in the kernel. staticRedistribute The state of redistributing static routes. kernelRedistribute The state of redistributing kernel routes. network The broadcast network on which RIP must run. Example set router rip -kernelRedistribute Related Commands unset router rip show router rip
unset router rip

Synopsis
Description Unset the RIP parameters..Refer to the set router rip command for meanings of the arguments.NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments Example unset rip -default-metric
Related Commands set router rip show router rip
show router rip

Synopsis
Description Display the RIP configuration. NOTE: This command is deprecated.All routing configurations have now been moved to vtysh Arguments ripOptions RIP option in show command, one of database or interface. Possible values: database, interface format level network The broadcast network on which RIP must run. netmask Example show rip interface
Related Commands set router rip unset router rip
Chapter
35
Sc Commands
Topics: stat sc add sc policy rm sc policy set sc policy unset sc policy show sc policy stat sc policy show sc stats set sc parameter unset sc parameter show sc parameter
1080 | Citrix NetScaler 10 | Sc Commands
stat sc
Synopsis stat sc [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display SureConnect statistics. Arguments SC condition triggered (ScTrigd) Number of times that SureConnect conditions were triggered. SC trigger condition failed Total number of times SureConnect was not triggered because the thresholds conditions failed. Policy matches Total number of incoming requests that matched configured sureconnect policies. SC responses sent Total number of in-memory java script served which throws the pop-up window. Reissued requests (ReissReq) Total number of reissued SureConnect requests. Valid reissued requests Total number of requests that were handled in a single SureConnect session. Alternate content requests Total number of alternate content served which throws the pop-up window. SC POST requests Total number of HTTP POST requests that triggered SureConnect feature. SC statistics timeout Toal number of times that SureConnect statistics were reset. Unsupported browsers Total number of requests that came from all unsupported browsers. Tampered SC cookies Total number of corrupted SureConnect cookies. Example
Related Commands stat sc policy
add sc policy
Synopsis add sc policy <name> [-url <URL> | -rule <expression>] [-delay <usecs>] [-maxConn <positive_integer>] [-action <action> (<altContentSvcName> <altContentPath>)] Description Add the SureConnect policy.
Citrix NetScaler 10 | Sc Commands | 1081
Arguments name The name of the SureConnect policy. url The URL name. The system matches the incoming client request against the URL you enter here. If the incoming request does not match any of the configured URLs or the rules that have been configured, then SureConnect does not trigger. rule The rule that the system matches with the incoming request. The system matches the incoming request against the rules you enter here. Before matching against the configured rules, the system matches the requests with any of the configured URLs. Thus, URLs have a higher precedence over rules. If the incoming request does not match any of the configured URLs or the rules that have been configured, then SureConnect does not trigger. Expression logic is expression names, separated by the logical operators || and && , and possibly grouped using parenthesis. If the expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes.The following are valid expression logic: ns_ext_cgi||ns_ext_asp ns_non_get && (ns_header_cookie||ns_header_pragma) delay The delay threshold in microseconds for the configured URL or the rule. If the delay statistics gathered for the configured URL or rule exceeds the configured delay, then SureConnect is triggered on the incoming request which matched the corresponding delay. Minimum value: 1 Maximum value: 599999999 maxConn The maximum number of concurrent connections that can be open for the configured URL or rule. You can enter this argument as any integer value greater than zero. Minimum value: 1 Maximum value: 4294967294 action The action to be taken when the thresholds are met. The valid options are ACS , NS and NOACTION . ACS - Specifies that alternate content is to be served from altContSvcName with the path altContPath . NS - Specifies that alternate content is to be served from the system. See the set sc parameter command to customize the response served from the system. NOACTION Specifies that no alternate content is to be served. However, delay statistics are still collected for the configured URLs. If the - maxconn argument is specified, the number of connections is limited to that specified value for that configured URL or rule (alternate content will not served even if the maxconn threshold is met). Possible values: ACS, NS, NOACTION altContentSvcName The alternate content service name used in the ACS action. altContentPath The alternate content path for the ACS action. Example add sc policy scpol_ns -delay 1000000 -url /delay.asp -action NS add policy expression exp_acs "url == /mc_acs.asp" add service svc_acs 10.110.100.253 http 80 add scpolicy scpol_acs maxconn 10 -rule exp_acs -action ACS svc_acs /altcont.htm Related Commands rm sc policy set sc policy unset sc policy
show sc policy stat sc policy
rm sc policy
Synopsis rm sc policy <name> Description Remove the SureConnect policy. Arguments name The name of the SureConnect policy. Example rm sc policy scpol_ns rm sc policy scpol_acs Related Commands add sc policy set sc policy unset sc policy show sc policy stat sc policy
set sc policy
Synopsis set sc policy <name> [-url <URL> | -rule <expression>] [-delay <usecs>] [-maxConn <positive_integer>] [-action <action> (<altContentSvcName> <altContentPath>)] Description Set the delay and maxConn parameters for the specified SureConnect policy. Arguments name The name of the SureConnect policy. url The URL name. The system matches the incoming client request against the URL you enter here. If the incoming request does not match any of the configured URLs or the rules that have been configured, then SureConnect does not trigger. rule The rule that the system matches with the incoming request. The system matches the incoming request against the rules you enter here. Before matching against the configured rules, the system matches the requests with any of the configured URLs. Thus, URLs have a higher precedence over rules. If the incoming request does not match any of the configured URLs or the rules that have been configured, then SureConnect does not trigger. Expression logic is expression names, separated by the logical operators || and && , and possibly grouped using parenthesis. If the
expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes.The following are valid expression logic: ns_ext_cgi||ns_ext_asp ns_non_get && (ns_header_cookie||ns_header_pragma) delay The delay threshold in microseconds for the configured URL or the rule. Minimum value: 1 Maximum value: 599999999 maxConn The maximum number of concurrent connections that can be open for the configured URL or rule. Minimum value: 1 Maximum value: 4294967294 action The action to be taken when the thresholds are met. The valid options are ACS , NS and NOACTION . ACS - Specifies that alternate content is to be served from altContSvcName with the path altContPath . NS - Specifies that alternate content is to be served from the system. See the set sc parameter command to customize the response served from the system. NOACTION Specifies that no alternate content is to be served. However, delay statistics are still collected for the configured URLs. If the - maxconn argument is specified, the number of connections is limited to that specified value for that configured URL or rule (alternate content will not served even if the maxconn threshold is met). Possible values: ACS, NS, NOACTION Example set sc policy scpol_ns -delay 2000000 set sc policy scpol_acs -maxconn 100 Related Commands add sc policy rm sc policy unset sc policy show sc policy stat sc policy
unset sc policy
Synopsis unset sc policy <name> [-delay] [-maxConn] Description Use this command to remove sc policy settings.Refer to the set sc policy command for meanings of the arguments. Arguments Example
Related Commands add sc policy rm sc policy set sc policy show sc policy
stat sc policy
show sc policy
Synopsis show sc policy [<name>] Description Display all of the Configured SureConnect policies. Arguments name The name of the SureConnect policy. summary fullValues format level url The URL name. The system matches the incoming client request against the URL you enter here. rule The rule that the system matches with the incoming request. The system matches the incoming request against the rules you enter here. Before matching against the configured rules, the NetScaler 9000 system matches the requests with any of the configured URLs. Thus, URLs have a higher precedence over rules. If the incoming request does not match any of the configured URLs or the rules that have been configured, then SureConnect does not trigger. Expression logic is expression names, separated by the logical operators || and && , and possibly grouped using parenthesis. If the expression contains blanks (for example, between an expression name and a logical operator), then the entire argument must be enclosed in double quotes.The following are valid expression logic: ns_ext_cgi||ns_ext_asp ns_non_get && (ns_header_cookie||ns_header_pragma) delay The delay threshold in microseconds for the configured URL or the rule. If the delay statistics gathered for the configured URL or rule exceeds the configured delay, then SureConnect is triggered on the incoming request which matched the corresponding delay. maxConn The maximum number of concurrent connections that can be open for the configured URL or rule. You can enter this argument as any integer value greater than zero. action The action to be taken when the thresholds are met. The valid options are ACS , NS and NOACTION . ACS - Specifies that alternate content is to be served from altContSvcName with the path altContPath . NS - Specifies that alternate content is to be served from the NetScaler 9000 system. See the set sc parameter command to customize the response served from the system. NOACTION - Specifies that no alternate content is to be served. However, delay statistics are still collected for the configured URLs. If the - maxconn argument is specified, the number of connections is limited to that specified value for that configured URL or rule (alternate content will not served even if the - maxconn threshold is met). altContentSvcName The alternate content service name used in the ACS action. altContentPath
The alternate content path for the ACS action. count stateflag Example > show sc policy 2 monitored Sure Connect Policies: 1) Name: scpol_ns RULE: exp1 Delay: 1000000 microsecs Alternate Content from NS 2) Name: scpol_acs RULE: exp_acs Max Conn: 10 Alternate Content from ACS, svc_acs /delay/alcont.htm Done Related Commands add sc policy rm sc policy set sc policy unset sc policy stat sc policy
stat sc policy
Synopsis stat sc policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display SureConnect policy statistics. Arguments name The name of the SC policy for which statistics will be displayed. If not given stati stics are shown for all SC policies. count devno stateflag Server TTLB (SvrTTLB) Server Time-To-Last-Byte in seconds calculated for this SureConnect policy. Server TTLB (SvrTTLB) Server Time-To-Last-Byte in seconds calculated for this SureConnect policy. Average server TTLB Average server transaction time in seconds for this SureConnect Policy. Average client TTLB (AvClTTLB) Average value of the client Time-To-Last-Byte in seconds for this SureConnect policy. Physical service IP (SvcIP) IP address of the service in dotted notation for which these statistics are maintained. Physical service port (SvcPort) Port of the service for which these statistics are maintained. Current client connections (CurClts)
Number of clients currently allowed a server connection by this SureConnect policy. Current SC queue length (WaitClts) Current number of SureConnect priority clients that are waiting for a server connection. Current server connections (CurSvrs) Current number of open connections to the servers matching this policy. Estimated waiting time (Sec) (WaitTime) Value of the currently estimated waiting time in seconds for the configured URL. Client TCP connections (TotClt) Total number of clients that were allowed a server connection by this SureConnect policy. Server TCP connections (TotSvr) Total number of server connections that were established through this SureConnect policy. Client HTTP transactions Total number of client transactions processed by this SureConnect policy. Server HTTP transactions (SrvTrans) Number of 200 OK responses received from the web server by this SureConnect policy. Requests received (TotReq) Total number of requests received by this SureConnect policy. Request bytes received (ReqBytes) Total number of request bytes received by this SureConnect policy. Server responses received (TotResp) Total number of server responses received by this SureConnect policy. Response bytes received (RspBytes) Total number of response bytes received by this SureConnect policy. Average client TTLB (AvClTTLB) Average value of the client Time-To-Last-Byte in seconds for this SureConnect policy. Server TTLB (SvrTTLB) Server Time-To-Last-Byte in seconds calculated for this SureConnect policy. Example
Related Commands add sc policy rm sc policy set sc policy unset sc policy show sc policy stat sc
show sc stats
Synopsis show sc stats - alias for 'stat sc'
Description show sc stats is an alias for stat sc Arguments Example
Related Commands stat sc
set sc parameter
Synopsis set sc parameter [-sessionLife <secs>] [-vsr <input_filename>] Description set the SureConnect parameters. Arguments sessionLife The time between the first time and next time the sureconnect alternet window display.The SureConnect alternate content window is displayed only once during a session. For the same browser accessing a configured URL.The value is in seconds. Default value: 300 Minimum value: 1 Maximum value: 4294967294 vsr The file containing the customized response that is to be displayed with ACTION as NS in the SureConnect policy. Default value: "DEFAULT" Example set sc parameter -sessionlife 200 -vsr /etc/vsr.htm Related Commands unset sc parameter show sc parameter
unset sc parameter
Synopsis unset sc parameter [-sessionLife] [-vsr] Description Use this command to remove sc parameter settings.Refer to the set sc parameter command for meanings of the arguments. Arguments Example
Related Commands set sc parameter show sc parameter
show sc parameter
Synopsis show sc parameter Description Display the SureConnect parameters set through the use of the ###set sc parameter### command. Arguments format level sessionLife The time between first time the Sureconnect aternate content window displays and the next time it displays.The SureConnect alternate content window is displayed only once during a session. For the same browser accessing a configured URL.The value is in seconds. vsr The customized response will be displayed to the user if the alternate content server has been determined by the system to have failed. If you have created a customized response that you want the system to use, enter its filename (if you renamed the vsr.htm file supplied by system). If you have not renamed the file, enter /etc/vsr.htm as the filename. Example > show sc parameter Sure Connect Parameters: Sessionlife: 300 Vsr: DEFAULT Done
Related Commands set sc parameter unset sc parameter
Chapter
36
Snmp Commands
Topics: stat snmp add snmp community rm snmp community show snmp community add snmp manager rm snmp manager set snmp manager unset snmp manager show snmp manager add snmp trap rm snmp trap set snmp trap unset snmp trap show snmp trap add snmp group rm snmp group set snmp group show snmp group add snmp view rm snmp view set snmp view show snmp view add snmp user rm snmp user set snmp user unset snmp user show snmp user show snmp oid show snmp stats set snmp alarm unset snmp alarm enable snmp alarm disable snmp alarm show snmp alarm set snmp mib unset snmp mib
1090 | Citrix NetScaler 10 | Snmp Commands
show snmp mib set snmp engineId unset snmp engineId show snmp engineId set snmp option unset snmp option show snmp option
Citrix NetScaler 10 | Snmp Commands | 1091
stat snmp
Synopsis stat snmp [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display snmp statistics. Arguments SNMP packets received (PktsRx) SNMP packets received. SNMP packets sent (PktsTx) SNMP packets transmitted. Get requests receieved (GetReqRx) SNMP Get-Request PDUs that have been accepted and processed. Get-next requests receieved (GtNextRx) SNMP Get-Next PDUs that have been accepted and processed. Get-bulk requests received (GtBulkRx) SNMP Get-Bulk PDUs that have been accepted and processed. Responses sent (RspTx) SNMP Get-Response PDUs that have been generated by the NetScaler. Traps messages sent (TrapsTx) SNMP Trap PDUs that have been generated by the NetScaler. Requests dropped (ReqDrop) SNMP requests dropped. ASN.1/BER errors in requests (PrsErrRx) Number of ASN.1 or BER errors encountered when decoding received SNMP Messages. Unsupported SNMP version (UnkVrsRx) Number of SNMP messages received, which were for an unsupported SNMP version. Unknown community name (UnkCNRx) SNMP messages received, which used an SNMP community name not known to the NetScaler. No permission on community (BadCURx) The total number of SNMP Messages received that represented an SNMP operation which was not allowed by the SNMP community named in the Message. Unsupported security level (UnkSecLv) SNMP packets that were dropped because they requested a security level that was unknown to the NetScaler or otherwise unavailable. Not in time window (NtTimeWd) SNMP packets that were dropped because they appeared outside of the authoritative SNMP engine's window. Unknown user name (UnkUser) SNMP packets that were dropped because they referenced a user that was not known to the SNMP engine. Unknown engine Id (UnkEngId)
SNMP packets that were dropped because they referenced an SNMP engine ID that was not known to the NetScaler. Wrong digest value (WrgDgst) SNMP packets that were dropped because they did not contain the expected digest value. Decryption errors (DcrptErr) SNMP packets that were dropped because they could not be decrypted. Example stat snmp
Related Commands
add snmp community

Synopsis add snmp community <communityName> <permissions> Description Set the SNMP community string to grant access to an SNMP network management application to manage the system. It also defines the specific management tasks that this user can perform. Tip: Use the add SNMP manager command to set the management privileges for the network management application. Arguments communityName The SNMP community string. permissions The access privileges. Possible values: GET, GET_NEXT, GET_BULK, ALL Example add snmp community public ALL add snmp community a#12ab GET_BULK
Related Commands rm snmp community show snmp community
rm snmp community
Synopsis rm snmp community <communityName> Description Remove the specified SNMP community string. Once the string is deleted, the user will not be able to use the community to manage the system. Arguments communityName SNMP community string
Example rm snmp community public Related Commands add snmp community show snmp community
show snmp community

Synopsis show snmp community [<communityName>] Description Display the access privileges set for all the SNMP community strings configured on the system. Arguments communityName SNMP community string summary fullValues format level permissions The access privileges. count stateflag Example show snmp community Related Commands add snmp community rm snmp community
add snmp manager

Synopsis add snmp manager <IPAddress> ... [-netmask <netmask>] [-domainResolveRetry <integer>] Description Configure the management application, which complies with SNMP version 1 or SNMP version 2, to access to the system. If at least one management station is not added through this command, network management applications from any host computer can access the system. The netmask parameter can be used to grant access from entire subnets. Up to a maximum of 100 IP based network management networks and 5 domain-name based hosts can be added.
Arguments IPAddress The IP/Network address or the hostname of the management station(s). Limit on IP based managers is 100 whereas limit on hostname based managers is 5. netmask The subnet of management stations. For hostname based managers, valid netmask is 255.255.255.255 Default value: 0xFFFFFFFF domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the hostname of snmp manager, in case the last query failed. If last query succeeds, then NS system waits for TTL time in response. Default value: 5 Minimum value: 5 Maximum value: 20939 Example add snmp manager 192.168.1.20 192.168.2.42 add snmp manager 192.168.2.16 -netmask 255.255.255.240 add snmp manager hostnamemanager.com Related Commands rm snmp manager set snmp manager unset snmp manager show snmp manager
rm snmp manager
Synopsis rm snmp manager <IPAddress> ... [-netmask <netmask>] Description Remove the access privileges from a management station, so that the management station no longer has access to the system. Arguments IPAddress The IP/Network address or the hostname of the management station. netmask The subnet of the management station. Default value: 0xFFFFFFFF Example rm snmp manager 192.168.1.20 rm snmp manager 192.168.2.16 -netmask 255.255.255.240 rm snmp manager hostnamemanager.com Related Commands add snmp manager set snmp manager unset snmp manager show snmp manager
set snmp manager

Synopsis set snmp manager <IPAddress> [-netmask <netmask>] [-domainResolveRetry <integer>] Description Set the domain resolve retry value for the hostname manager. Minimum value should be 5. Resolve retry cannot be set for IP based manager. Arguments IPAddress Hostname of the management station. netmask The subnet of the management station. Default value: 0xFFFFFFFF domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the hostname of snmp manager, in case the last query failed. If last query succeeds, then NS system waits for TTL time in response. Default value: 5 Minimum value: 5 Maximum value: 20939 Example set snmp manager www.example.com -domainResolveRetry 7 Related Commands add snmp manager rm snmp manager unset snmp manager show snmp manager
unset snmp manager

Synopsis unset snmp manager <IPAddress> -netmask <netmask> -domainResolveRetry Description Use this command to remove snmp manager settings.Refer to the set snmp manager command for meanings of the arguments. Arguments Example
Related Commands add snmp manager rm snmp manager set snmp manager
show snmp manager
show snmp manager

Synopsis show snmp manager [<IPAddress> [-netmask <netmask>]] Description Display the management stations that are allowed to manage the system. The managers can be either IP based or domain-name based. The managers are listed by their IP addresses, netmasks, resolve retry, resolved IP and hostname. For IP based manager, resolved IP and hostname fields will be irrelevant whereas for hostname manager, IP address field will be irrelevant. Arguments IPAddress The IP/Network address or hostname of the management station. summary fullValues format level IP The resolved IP address of the hostname manager domain IP address of manager. It will be zero for hostname manager domainResolveRetry The duration in seconds for which NetScaler system waits to send the next dns query to resolve the hostname of snmp manager, in case the last query failed. If last query succeeds, then NS system waits for TTL time in response. count stateflag Example show snmp manager Related Commands add snmp manager rm snmp manager set snmp manager unset snmp manager
add snmp trap

Synopsis add snmp trap <trapClass> <trapDestination> ... [-version ( V1 | V2 )] [-destPort <port>] [-communityName <string>] [-srcIP <ip_addr|ipv6_addr>] [-severity <severity>]
Description Create SNMP traps. The SNMP traps are asynchronous events generated by the agent to indicate the state of the system. The destination to which these traps should be sent by the system is configured via this command. Arguments trapClass The Trap type. The Generic type causes the standard SNMP traps supported by the system to be sent to the destination, while the Specific trap type sets the destination for specific traps. Possible values: generic, specific trapDestination The IP address of the trap destination. version The SNMP version of the trap PDU to be sent. Possible values: V1, V2 Default value: TRAP_VERSION_2 destPort The destination port of the SNMP trap. Default value: 162 Minimum value: 1 Maximum value: 65534 communityName SNMP trap community string Default value: "public" srcIP The source IP of the SNMP traps. By default it is the NetScaler IP. severity The minimum severity of the alarms to be sent to this trap destination. By default all traps will be sent to this trap destination. Possible values: Critical, Major, Minor, Warning, Informational Default value: SNMP_SEV_UNKNOWN Example
Related Commands rm snmp trap set snmp trap unset snmp trap show snmp trap
rm snmp trap
Synopsis rm snmp trap <trapClass> <trapDestination> ... Description Remove a trap destination that has been set. Arguments trapClass The Trap type. Possible values: generic, specific trapDestination The IP address of the trap destination.
Example
Related Commands add snmp trap set snmp trap unset snmp trap show snmp trap
set snmp trap

Synopsis set snmp trap <trapClass> <trapDestination> [-destPort <port>] [-version ( V1 | V2 )] [-communityName <string>] [srcIP <ip_addr|ipv6_addr>] [-severity <severity>] Description Set the SNMP version of trap PDU and source IP of SNMP traps for configured trap destinations. Arguments trapClass The Trap type. Possible values: generic, specific trapDestination The IP address of the trap destination. destPort The destination port of the SNMP trap. Default value: 162 Minimum value: 1 Maximum value: 65534 version The SNMP version of the trap PDU to be sent. Possible values: V1, V2 Default value: TRAP_VERSION_2 communityName SNMP trap community string Default value: "public" srcIP The source IP of the SNMP traps. By default it is the NetScaler IP. severity The minimum severity of the alarms to be sent to the trap destination. Possible values: Critical, Major, Minor, Warning, Informational Default value: SNMP_SEV_UNKNOWN Example set snmp trap generic 192.168.3.4 -version V1 Related Commands add snmp trap rm snmp trap unset snmp trap show snmp trap
unset snmp trap

Synopsis unset snmp trap <trapClass> <trapDestination> [-destPort] [-version] [-communityName] [-srcIP] [-severity] Description Unset the SNMP version of trap PDU and source IP of SNMP traps for configured trap destinations..Refer to the set snmp trap command for meanings of the arguments. Arguments Example unset snmp trap generic 192.168.3.4 -version Related Commands add snmp trap rm snmp trap set snmp trap show snmp trap
show snmp trap

Synopsis show snmp trap [<trapClass> <trapDestination>] Description Display the IP addresses of the SNMP managers to which the system sends traps and the version of the PDU to be used for these destinations. Arguments trapClass The trap type. Possible values: generic, specific summary fullValues format level destPort The destination port of the SNMP trap. version The SNMP version of the trap to be sent. communityName SNMP trap community string srcIP The source IP of the SNMP trap to be sent.
severity The minimum severity of traps to be sent to this destination. count stateflag Example show snmp trap Related Commands add snmp trap rm snmp trap set snmp trap unset snmp trap
add snmp group

Synopsis add snmp group <name> <securityLevel> -readViewName <string> Description Use this command to add an snmp group. Arguments name The name of the SNMP group. securityLevel The security level of the group. Possible values: noAuthNoPriv, authNoPriv, authPriv readViewName The name of the read view associated with this view. Example
Related Commands rm snmp group set snmp group show snmp group
rm snmp group
Synopsis rm snmp group <name> <securityLevel> Description Use this command to delete an snmp group.
Arguments name The name of the SNMP group. securityLevel The security level of the group. Possible values: noAuthNoPriv, authNoPriv, authPriv Example
Related Commands add snmp group set snmp group show snmp group
set snmp group

Synopsis set snmp group <name> <securityLevel> -readViewName <string> Description Use this command to set snmp group parameters. Arguments name The name of the SNMP group. securityLevel The security level of the group. Possible values: noAuthNoPriv, authNoPriv, authPriv readViewName The name of the read view associated with this view. Example
Related Commands add snmp group rm snmp group show snmp group
show snmp group

Synopsis show snmp group [<name> <securityLevel>] Description Display the configured SNMP groups. Arguments name
The name of the SNMP group. securityLevel The security level of the group. Possible values: noAuthNoPriv, authNoPriv, authPriv summary fullValues format level readViewName The name of the read view associated with this view. storageType The storage type for this group. status The status of this group. count stateflag Example
Related Commands add snmp group rm snmp group set snmp group
add snmp view

Synopsis add snmp view <name> <subtree> -type ( included | excluded ) Description Use this command to add an snmp view. Arguments name The name of the SNMP view. subtree The subtree which is a part of the view. type The sutree needs to be included or excluded. Possible values: included, excluded Example
Related Commands rm snmp view
set snmp view show snmp view
rm snmp view
Synopsis rm snmp view <name> <subtree> Description Use this command to delete an snmp view. Arguments name The name of the SNMP view. subtree The subtree which is a part of the view. Example
Related Commands add snmp view set snmp view show snmp view
set snmp view

Synopsis set snmp view <name> <subtree> -type ( included | excluded ) Description Use this command to set snmp view parameters. Arguments name The name of the SNMP view. subtree The subtree which is a part of the view. type The sutree needs to be included or excluded. Possible values: included, excluded Example
Related Commands add snmp view rm snmp view
show snmp view
show snmp view

Synopsis show snmp view [<name> [<subtree>]] Description Display the configured SNMP views. Arguments name The name of the SNMP view. summary fullValues format level type The type of sutree. storageType The storage type for this view. status The status of this view. count stateflag Example
Related Commands add snmp view rm snmp view set snmp view
add snmp user

Synopsis add snmp user <name> -group <string> [-authType ( MD5 | SHA ) {-authPasswd } [-privType ( DES | AES ) {privPasswd }]] Description Use this command to create a SNMP user. Arguments name The name of the SNMP user.
group The name of the group to which user belongs. authType The authentication type. Possible values: MD5, SHA privType The encryption type. Possible values: DES, AES Example
Related Commands rm snmp user set snmp user unset snmp user show snmp user
rm snmp user
Synopsis rm snmp user <name> Description Use this command to delete an SNMP user. Arguments name The name of the SNMP user. Example
Related Commands add snmp user set snmp user unset snmp user show snmp user
set snmp user

Synopsis set snmp user <name> [-group <string>] [-authType ( MD5 | SHA ) {-authPasswd }] [-privType ( DES | AES ) {privPasswd }] Description Use this command to set parameters of an SNMP user. Arguments name
The name of the SNMP user. group The name of the group to which user belongs. authType The authentication type. Possible values: MD5, SHA privType The encryption type. Possible values: DES, AES Example
Related Commands add snmp user rm snmp user unset snmp user show snmp user
unset snmp user

Synopsis unset snmp user <name> (-authType | -privType) [-authPasswd] [-privPasswd] Description Use this command to unset parameters of an SNMP user..Refer to the set snmp user command for meanings of the arguments. Arguments Example
Related Commands add snmp user rm snmp user set snmp user show snmp user
show snmp user

Synopsis show snmp user [<name>] Description Display configured SNMP users. Arguments name The name of the SNMP user.
summary fullValues format level group The name of the group to which user belongs. authType The authentication type. privType The encryption type. engineID The context engine ID of the user. storageType The storage type for this user. status The status of this user. count stateflag Example
Related Commands add snmp user rm snmp user set snmp user unset snmp user
show snmp oid

Synopsis show snmp oid <entityType> [<name>] Description Display the SNMP OID index for entities of given type. Arguments entityType The entity type. Possible values: VSERVER, SERVICE, SERVICEGROUP name The name of the entity. summary fullValues
snmpOID The snmp oid. stateflag state flag count Example show snmp oid VSERVER vs1 Related Commands
show snmp stats

Synopsis show snmp stats - alias for 'stat snmp' Description show snmp stats is an alias for stat snmp Arguments Example
Related Commands stat snmp
set snmp alarm

Synopsis set snmp alarm <trapName> [-thresholdValue <positive_integer> [-normalValue <positive_integer>]] [-time <secs>] [-state ( ENABLED | DISABLED )] [-severity <severity>] [-logging ( ENABLED | DISABLED )] Description Configure the user-configurable SNMP alarms. For each configured alarm, an SNMP trap is sent when the value exceeds the specified high threshold. When the value falls below the normal threshold, another SNMP trap is sent indicating a return-to-normal state. Note: For any alarm, after a high threshold trap has been sent, it is not sent again until the monitored value falls back to normal. System supports following user configurable alarms - HASTATE-CHANGE: Change to primary/secondary CPU-USAGE: Individual CPU usage AVERAGE-CPU: Average CPU usage ENTITY-STATE: Entity state change SYNFLOOD: Global unacknowledged SYN count MEMORY: Memory usage VSERVER-REQRATE: Vserver specific request rate SERVICE-REQRATE: Service specific request rate ENTITY-RXRATE: Entity specific Rx bytes per sec ENTITY-TXRATE: Entity specific Tx bytes per sec ENTITY-SYNFLOOD: Entity specific unacknowledged SYN count CONFIG-CHANGE: System configuration changed SERVICE-MAXCLIENTS: Service hit max-client limit CONFIG-SAVE: System configuration was saved SERVICEGROUP-MEMBER-REQRATE: Request rate on a service group member SERVICEGROUPMEMBER-MAXCLIENTS: Service group member hits max-client MONITOR-RTO-THRESHOLD: Monitor probe response timeout LOGIN-FAILURE: GUI/CLI/API login failure SSL-CERT-EXPIRY: Certificate expiry FANSPEED-LOW: Low fan speed VOLTAGE-LOW: Low voltage VOLTAGE-HIGH: High Voltage TEMPERATUREHIGH: High temperature CPU-TEMPERATURE-HIGH: High CPU temperature POWER-SUPPLY-FAILURE: Power supply failure DISK-USAGE-HIGH: High disk usage INTERFACE-THROUGHPUT-LOW: Low Interface
throughput MON_PROBE_FAILED: Monitor probe failure HA-VERSION-MISMATCH: HA netscaler's OS version mismatch HA-SYNC-FAILURE: HA config synchronization failure HA-NO-HEARTBEATS: No HA hearbeats HA-BAD-SECONDARY-STATE: Secondary state DOWN/UNKNOWN/STAY SECONDARY INTERFACEBW-USAGE: System aggregate BW usage RATE-LIMIT-THRESHOLD-EXCEEDED: Client exceed rate-limit threshold ENTITY-NAME-CHANGE: Entity name change HA-PROP-FAILURE: HA config propagation failure IP-CONFLICT: IP conflict PF-RL-RATE-THRESHOLD: Platform rate limit in Mbps PF-RL-PPS-THRESHOLD: Platform packets per second limit PF-RL-RATE-PKTS-DROPPED: Packet Drops due to platform rate limit PFRL-PPS-PKTS-DROPPED: Packet Drops due to platform packet per sec limit APPFW-START-URL: AppFirewall Start URL violation APPFW-DENY-URL: AppFirewall Deny URL violation APPFW-REFERER-HEADER: AppFirewall Referer Header violation APPFW-CSRF-TAG: AppFirewall CSRF Tag violation APPFW-COOKIE: AppFirewall Cookie violation APPFW-FIELD-CONSISTENCY: AppFirewall Field Consistency violation APPFWBUFFER-OVERFLOW: AppFirewall Buffer Overflow violation APPFW-FIELD-FORMAT: AppFirewall Field Format violation APPFW-SAFE-COMMERCE: AppFirewall Safe Commerce violation APPFW-SAFE-OBJECT: AppFirewall Safe Object violation APPFW-POLICY-HIT: AppFirewall Policy Hit APPFW-XSS: AppFirewall Cross Site Scripting violation APPFW-XML-XSS: AppFirewall XML Cross Site Scripting violation APPFW-SQL: AppFirewall SQL violation APPFW-XML-SQL: AppFirewall XML SQL violation APPFW-XML-ATTACHMENT: AppFirewall XML Attachment violation APPFW-XML-DOS: AppFirewall XML DoS violation APPFW-XMLVALIDATION: AppFirewall XML Validation violation APPFW-XML-WSI: AppFirewall XML WSI violation APPFW-XML-SCHEMA-COMPILE: AppFirewall XML Schema Compile violation APPFW-XML-SOAPFAULT: AppFirewall XML Soap Fault violation DNSKEY-EXPIRY: DNSKEY expiry DATASTREAM-RATELIMIT-HIT: DataStream Rate Limit Hit HA-LICENSE-MISMATCH: HA netscaler's license mismatch SSLCARD-FAILED: SSL Card Failed SSL-CARD-NORMAL: SSL Card Normal WARM-RESTART-EVENT: Warm Restart Event Occurred HARD-DISK-DRIVE-ERRORS: Hard Disk Drive Errors COMPACT-FLASHERRORS: Compact Flash Errors CALLHOME-UPLOAD-EVENT: Attempt to upload Show Tech Support Archive 1024KEY-EXCHANGE-RATE: 1024 Key Exchange Rate 2048KEY-EXCHANGE-RATE: 2048 Key Exchange Rate 4096KEY-EXCHANGE-RATE: 4096 Key Exchange Rate SSL-CUR-SESSION-INUSE: SSL Current Sessions In Use For the purposes of this command, entity includes vservers and services. Note: 1. These traps are sent to "specific" trap destinations added via the 'add snmp trap specific'. 2. Thresholds for SERVICE-MAXCLIENTS should be set through 'set service <name> -maxClients <n>'. Arguments trapName The name of the alarm. Possible values: CPU-USAGE, AVERAGE-CPU, MEMORY, SYNFLOOD, VSERVER-REQRATE, SERVICE-REQRATE, ENTITY-RXRATE, ENTITYTXRATE, ENTITY-SYNFLOOD, SERVICE-MAXCLIENTS, HA-STATE-CHANGE, ENTITYSTATE, CONFIG-CHANGE, CONFIG-SAVE, SERVICEGROUP-MEMBER-REQRATE, SERVICEGROUP-MEMBER-MAXCLIENTS, MONITOR-RTO-THRESHOLD, LOGINFAILURE, SSL-CERT-EXPIRY, FAN-SPEED-LOW, VOLTAGE-LOW, VOLTAGE-HIGH, TEMPERATURE-HIGH, CPU-TEMPERATURE-HIGH, POWER-SUPPLY-FAILURE, DISKUSAGE-HIGH, INTERFACE-THROUGHPUT-LOW, MON_PROBE_FAILED, HA-VERSIONMISMATCH, HA-SYNC-FAILURE, HA-NO-HEARTBEATS, HA-BAD-SECONDARYSTATE, INTERFACE-BW-USAGE, RATE-LIMIT-THRESHOLD-EXCEEDED, ENTITYNAME-CHANGE, HA-PROP-FAILURE, IP-CONFLICT, PF-RL-RATE-THRESHOLD, PFRL-PPS-THRESHOLD, PF-RL-RATE-PKTS-DROPPED, PF-RL-PPS-PKTS-DROPPED, APPFW-START-URL, APPFW-DENY-URL, APPFW-REFERER-HEADER, APPFW-CSRFTAG, APPFW-COOKIE, APPFW-FIELD-CONSISTENCY, APPFW-BUFFER-OVERFLOW, APPFW-FIELD-FORMAT, APPFW-SAFE-COMMERCE, APPFW-SAFE-OBJECT, APPFWPOLICY-HIT, APPFW-XSS, APPFW-XML-XSS, APPFW-SQL, APPFW-XML-SQL, APPFWXML-ATTACHMENT, APPFW-XML-DOS, APPFW-XML-VALIDATION, APPFW-XMLWSI, APPFW-XML-SCHEMA-COMPILE, APPFW-XML-SOAP-FAULT, DNSKEY-EXPIRY, DATASTREAM-RATE-LIMIT-HIT, HA-LICENSE-MISMATCH, SSL-CARD-FAILED, SSLCARD-NORMAL, WARM-RESTART-EVENT, HARD-DISK-DRIVE-ERRORS, COMPACTFLASH-ERRORS, CALLHOME-UPLOAD-EVENT, 1024KEY-EXCHANGE-RATE, 2048KEYEXCHANGE-RATE, 4096KEY-EXCHANGE-RATE, SSL-CUR-SESSION-INUSE thresholdValue The high threshold value that triggers the alarm. Minimum value: 1
time The time interval for SYNFLOOD, HA-VERSION-MISMATCH, HA-SYNC-FAILURE, HA-NOHEARTBEATS, HA-BAD-SECONDARY-STATE, HA-PROP-FAILURE, IP-CONFLICT, HALICENSE-MISMATCH and APPFW alarms only. Default value: 1 state The current state of the alarm. Possible values: ENABLED, DISABLED Default value: ENABLED severity The severity level of this alarm. Possible values: Critical, Major, Minor, Warning, Informational Default value: SNMP_SEV_UNKNOWN logging The logging status of the alarm. Possible values: ENABLED, DISABLED Default value: ENABLED Example set snmp alarm VSERVER-REQRATE -thresholdValue 10000 -normalValue 100 Related Commands unset snmp alarm enable snmp alarm disable snmp alarm show snmp alarm
unset snmp alarm

Synopsis unset snmp alarm <trapName> [-thresholdValue | -normalValue | -time | -state | -severity | -logging] Description Unset a user-configurable SNMP alarm..Refer to the set snmp alarm command for meanings of the arguments. Arguments Example unset snmp alarm VSERVER-REQRATE Related Commands set snmp alarm enable snmp alarm disable snmp alarm show snmp alarm
enable snmp alarm

Synopsis enable snmp alarm <trapName> ...
Description Enable the specified SNMP alarm. Arguments trapName The alarm to be enabled. Possible values: CPU-USAGE, AVERAGE-CPU, MEMORY, SYNFLOOD, VSERVER-REQRATE, SERVICE-REQRATE, ENTITY-RXRATE, ENTITYTXRATE, ENTITY-SYNFLOOD, SERVICE-MAXCLIENTS, HA-STATE-CHANGE, ENTITYSTATE, CONFIG-CHANGE, CONFIG-SAVE, SERVICEGROUP-MEMBER-REQRATE, SERVICEGROUP-MEMBER-MAXCLIENTS, MONITOR-RTO-THRESHOLD, LOGINFAILURE, SSL-CERT-EXPIRY, FAN-SPEED-LOW, VOLTAGE-LOW, VOLTAGE-HIGH, TEMPERATURE-HIGH, CPU-TEMPERATURE-HIGH, POWER-SUPPLY-FAILURE, DISKUSAGE-HIGH, INTERFACE-THROUGHPUT-LOW, MON_PROBE_FAILED, HA-VERSIONMISMATCH, HA-SYNC-FAILURE, HA-NO-HEARTBEATS, HA-BAD-SECONDARYSTATE, INTERFACE-BW-USAGE, RATE-LIMIT-THRESHOLD-EXCEEDED, ENTITYNAME-CHANGE, HA-PROP-FAILURE, IP-CONFLICT, PF-RL-RATE-THRESHOLD, PFRL-PPS-THRESHOLD, PF-RL-RATE-PKTS-DROPPED, PF-RL-PPS-PKTS-DROPPED, APPFW-START-URL, APPFW-DENY-URL, APPFW-REFERER-HEADER, APPFW-CSRFTAG, APPFW-COOKIE, APPFW-FIELD-CONSISTENCY, APPFW-BUFFER-OVERFLOW, APPFW-FIELD-FORMAT, APPFW-SAFE-COMMERCE, APPFW-SAFE-OBJECT, APPFWPOLICY-HIT, APPFW-XSS, APPFW-XML-XSS, APPFW-SQL, APPFW-XML-SQL, APPFWXML-ATTACHMENT, APPFW-XML-DOS, APPFW-XML-VALIDATION, APPFW-XMLWSI, APPFW-XML-SCHEMA-COMPILE, APPFW-XML-SOAP-FAULT, DNSKEY-EXPIRY, DATASTREAM-RATE-LIMIT-HIT, HA-LICENSE-MISMATCH, SSL-CARD-FAILED, SSLCARD-NORMAL, WARM-RESTART-EVENT, HARD-DISK-DRIVE-ERRORS, COMPACTFLASH-ERRORS, CALLHOME-UPLOAD-EVENT, 1024KEY-EXCHANGE-RATE, 2048KEYEXCHANGE-RATE, 4096KEY-EXCHANGE-RATE, SSL-CUR-SESSION-INUSE Example enable snmp alarm VSERVER-REQRATE enable snmp alarm CPU SYNFLOOD Related Commands set snmp alarm unset snmp alarm disable snmp alarm show snmp alarm
disable snmp alarm

Synopsis disable snmp alarm <trapName> ... Description Disable the specified SNMP alarm. Arguments trapName The alarm to be disabled. Possible values: CPU-USAGE, AVERAGE-CPU, MEMORY, SYNFLOOD, VSERVER-REQRATE, SERVICE-REQRATE, ENTITY-RXRATE, ENTITYTXRATE, ENTITY-SYNFLOOD, SERVICE-MAXCLIENTS, HA-STATE-CHANGE, ENTITYSTATE, CONFIG-CHANGE, CONFIG-SAVE, SERVICEGROUP-MEMBER-REQRATE,
SERVICEGROUP-MEMBER-MAXCLIENTS, MONITOR-RTO-THRESHOLD, LOGINFAILURE, SSL-CERT-EXPIRY, FAN-SPEED-LOW, VOLTAGE-LOW, VOLTAGE-HIGH, TEMPERATURE-HIGH, CPU-TEMPERATURE-HIGH, POWER-SUPPLY-FAILURE, DISKUSAGE-HIGH, INTERFACE-THROUGHPUT-LOW, MON_PROBE_FAILED, HA-VERSIONMISMATCH, HA-SYNC-FAILURE, HA-NO-HEARTBEATS, HA-BAD-SECONDARYSTATE, INTERFACE-BW-USAGE, RATE-LIMIT-THRESHOLD-EXCEEDED, ENTITYNAME-CHANGE, HA-PROP-FAILURE, IP-CONFLICT, PF-RL-RATE-THRESHOLD, PFRL-PPS-THRESHOLD, PF-RL-RATE-PKTS-DROPPED, PF-RL-PPS-PKTS-DROPPED, APPFW-START-URL, APPFW-DENY-URL, APPFW-REFERER-HEADER, APPFW-CSRFTAG, APPFW-COOKIE, APPFW-FIELD-CONSISTENCY, APPFW-BUFFER-OVERFLOW, APPFW-FIELD-FORMAT, APPFW-SAFE-COMMERCE, APPFW-SAFE-OBJECT, APPFWPOLICY-HIT, APPFW-XSS, APPFW-XML-XSS, APPFW-SQL, APPFW-XML-SQL, APPFWXML-ATTACHMENT, APPFW-XML-DOS, APPFW-XML-VALIDATION, APPFW-XMLWSI, APPFW-XML-SCHEMA-COMPILE, APPFW-XML-SOAP-FAULT, DNSKEY-EXPIRY, DATASTREAM-RATE-LIMIT-HIT, HA-LICENSE-MISMATCH, SSL-CARD-FAILED, SSLCARD-NORMAL, WARM-RESTART-EVENT, HARD-DISK-DRIVE-ERRORS, COMPACTFLASH-ERRORS, CALLHOME-UPLOAD-EVENT, 1024KEY-EXCHANGE-RATE, 2048KEYEXCHANGE-RATE, 4096KEY-EXCHANGE-RATE, SSL-CUR-SESSION-INUSE Example disable snmp alarm VSERVER-REQRATE disable snmp alarm CPU SYNFLOOD Related Commands set snmp alarm unset snmp alarm enable snmp alarm show snmp alarm
show snmp alarm

Synopsis show snmp alarm [<trapName>] Description Displays the alarm thresholds for the user-configurable traps. Arguments trapName The name of the alarm. Possible values: CPU-USAGE, AVERAGE-CPU, MEMORY, SYNFLOOD, VSERVER-REQRATE, SERVICE-REQRATE, ENTITY-RXRATE, ENTITYTXRATE, ENTITY-SYNFLOOD, SERVICE-MAXCLIENTS, HA-STATE-CHANGE, ENTITYSTATE, CONFIG-CHANGE, CONFIG-SAVE, SERVICEGROUP-MEMBER-REQRATE, SERVICEGROUP-MEMBER-MAXCLIENTS, MONITOR-RTO-THRESHOLD, LOGINFAILURE, SSL-CERT-EXPIRY, FAN-SPEED-LOW, VOLTAGE-LOW, VOLTAGE-HIGH, TEMPERATURE-HIGH, CPU-TEMPERATURE-HIGH, POWER-SUPPLY-FAILURE, DISKUSAGE-HIGH, INTERFACE-THROUGHPUT-LOW, MON_PROBE_FAILED, HA-VERSIONMISMATCH, HA-SYNC-FAILURE, HA-NO-HEARTBEATS, HA-BAD-SECONDARYSTATE, INTERFACE-BW-USAGE, RATE-LIMIT-THRESHOLD-EXCEEDED, ENTITYNAME-CHANGE, HA-PROP-FAILURE, IP-CONFLICT, PF-RL-RATE-THRESHOLD, PFRL-PPS-THRESHOLD, PF-RL-RATE-PKTS-DROPPED, PF-RL-PPS-PKTS-DROPPED, APPFW-START-URL, APPFW-DENY-URL, APPFW-REFERER-HEADER, APPFW-CSRFTAG, APPFW-COOKIE, APPFW-FIELD-CONSISTENCY, APPFW-BUFFER-OVERFLOW,
APPFW-FIELD-FORMAT, APPFW-SAFE-COMMERCE, APPFW-SAFE-OBJECT, APPFWPOLICY-HIT, APPFW-XSS, APPFW-XML-XSS, APPFW-SQL, APPFW-XML-SQL, APPFWXML-ATTACHMENT, APPFW-XML-DOS, APPFW-XML-VALIDATION, APPFW-XMLWSI, APPFW-XML-SCHEMA-COMPILE, APPFW-XML-SOAP-FAULT, DNSKEY-EXPIRY, DATASTREAM-RATE-LIMIT-HIT, HA-LICENSE-MISMATCH, SSL-CARD-FAILED, SSLCARD-NORMAL, WARM-RESTART-EVENT, HARD-DISK-DRIVE-ERRORS, COMPACTFLASH-ERRORS, CALLHOME-UPLOAD-EVENT, 1024KEY-EXCHANGE-RATE, 2048KEYEXCHANGE-RATE, 4096KEY-EXCHANGE-RATE, SSL-CUR-SESSION-INUSE summary fullValues format level thresholdValue The high threshold value. normalValue The normal threshold value. time The time interval for the SYNFLOOD alarm. state The current state of the alarm. severity The severity of this alarm. logging The log status of the alarm. flags count stateflag Example
Related Commands set snmp alarm unset snmp alarm enable snmp alarm disable snmp alarm
set snmp mib

Synopsis set snmp mib [-contact <string>] [-name <string>] [-location <string>] [-customID <string>] Description Set the system SNMP MIB information of the system.
Arguments contact The contact person for the system. Default value: "WebMaster (default)" name The name of the system. Default value: "NetScaler" location The physical location of the system. Default value: "POP (default)" customID Custom ID for the system. Default value: "Default" Example
Related Commands unset snmp mib show snmp mib
unset snmp mib

Synopsis unset snmp mib [-contact] [-name] [-location] [-customID] Description Use this command to remove snmp mib settings.Refer to the set snmp mib command for meanings of the arguments. Arguments Example
Related Commands set snmp mib show snmp mib
show snmp mib

Synopsis show snmp mib Description Display the information from the SNMP system MIB in the system. The information that is displayed depends on what was specified when the set snmp mib CLI command was issued. Arguments format level contact The contact person for the system.
name The name of the system. location The physical location of the system. sysDesc The description of the system. sysUptime The UP time of the system in 100th of a second. sysServices The services offered by the system. sysOID The OID of the system's management system. customID Custom ID for the system. Example show snmp mib
Related Commands set snmp mib unset snmp mib
set snmp engineId

Synopsis set snmp engineId <engineID> Description Use this command to set the SNMP engine ID. Arguments engineID The engine ID of the SNMP agent. Example
Related Commands unset snmp engineId show snmp engineId
unset snmp engineId

Synopsis unset snmp engineId
Description Use this command to unset the SNMP engine ID..Refer to the set snmp engineId command for meanings of the arguments. Arguments Example
Related Commands set snmp engineId show snmp engineId
show snmp engineId

Synopsis show snmp engineId Description Use this command to display the SNMP engine ID. Arguments format level engineID The engine ID of the SNMP agent. Example
Related Commands set snmp engineId unset snmp engineId
set snmp option

Synopsis set snmp option [-snmpset ( ENABLED | DISABLED )] [-snmpTrapLogging ( ENABLED | DISABLED )] Description Use this command to set snmp options. Arguments snmpset The state of snmpset option. Possible values: ENABLED, DISABLED Default value: DISABLED snmpTrapLogging
The state of the logging of snmp traps. By default, system will log all snmp trap events when trap destinations are configured. If this option is enabled trap events will be logged even when trap destinations are not configured. Possible values: ENABLED, DISABLED Default value: DISABLED Example
Related Commands unset snmp option show snmp option
unset snmp option

Synopsis unset snmp option [-snmpset] [-snmpTrapLogging] Description Use this command to remove snmp option settings.Refer to the set snmp option command for meanings of the arguments. Arguments Example
Related Commands set snmp option show snmp option
show snmp option

Synopsis show snmp option Description Use this command to get snmp option. Arguments format level snmpset The state of snmpset option. snmpTrapLogging The state of the logging of snmp traps. By default, system will log all snmp trap events when trap destinations are configured. If this option is enabled trap events will be logged even when trap destinations are not configured.
Example
Related Commands set snmp option unset snmp option
Chapter
37
Ssl Commands
Topics: stat ssl create ssl fipsKey rm ssl fipsKey show ssl fipsKey import ssl fipsKey export ssl fipsKey create ssl wrapkey rm ssl wrapkey show ssl wrapkey add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey add ssl cipher bind ssl cipher show ssl cipher rm ssl cipher add ssl crl create ssl crl rm ssl crl set ssl crl unset ssl crl show ssl crl add ssl action rm ssl action show ssl action add ssl policy rm ssl policy set ssl policy unset ssl policy
1120 | Citrix NetScaler 10 | Ssl Commands
show ssl policy add ssl policylabel rm ssl policylabel bind ssl policylabel unbind ssl policylabel show ssl policylabel add ssl ocspResponder rm ssl ocspResponder set ssl ocspResponder unset ssl ocspResponder show ssl ocspResponder create ssl rsakey convert ssl pkcs12 convert ssl pkcs8 create ssl dhParam create ssl dsaKey show ssl certLink create ssl certReq create ssl cert show ssl stats set ssl parameter unset ssl parameter show ssl parameter set ssl fips unset ssl fips reset ssl fips show ssl fips update ssl fips set ssl service unset ssl service bind ssl service unbind ssl service show ssl service set ssl serviceGroup unset ssl serviceGroup show ssl serviceGroup set ssl vserver unset ssl vserver bind ssl vserver unbind ssl vserver show ssl vserver enable ssl fipsSIMTarget init ssl fipsSIMTarget enable ssl fipsSIMSource init ssl fipsSIMSource bind ssl global unbind ssl global show ssl global
Citrix NetScaler 10 | Ssl Commands | 1121
stat ssl
Synopsis stat ssl [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display ssl statistics. Arguments # SSL cards UP (SSLCardUP) Number of SSL cards that are UP. If the number of cards UP is lower than a threshold, a failover is initiated. SSL crypto card status (SSLCardSt) Status of the SSL card(s). The value should be interpreted in binary form, with each set bit indicates a card as UP. # SSL cards present (SSLCards) Number of SSL crypto cards present on the NetScaler appliance. SSL engine status (SSLEngSt) State of the SSL Engine (1=UP/0=DOWN). This state is decided based on SSL Feature/License status and minimum number of cards UP. SSL sessions (SSLSe) Number of SSL sessions on the NetScaler appliance. SSL transactions (SSLTrn) Number of SSL transactions on the NetScaler appliance. SSLv2 transactions (SSL2Trn) Number of SSLv2 transactions on the NetScaler appliance. SSLv3 transactions (SSL3Trn) Total number of SSLv3 transactions on the NetScaler appliance. TLSv1 transactions (TLS1Trn) Number of TLSv1 transactions on the NetScaler appliance. SSLv2 sessions (SSL2Se) Number of SSLv2 sessions on the NetScaler appliance. SSLv3 sessions (SSL3Se) Number of SSLv3 sessions on the NetScaler appliance. TLSv1 sessions (TLS1Se) Number of TLSv1 sessions on the NetScaler appliance. new SSL sessions (NewSe) Number of new SSL sessions created on the NetScaler appliance. SSL session misses (SeMiss) Number of SSL session reuse misses on the NetScaler appliance. SSL session hits (SeHit) Number of SSL session reuse hits on the NetScaler appliance. SSL sessions (BSSLSe) Number of back-end SSL sessions on the NetScaler appliance. SSLv3 sessions (BSSL3Se)
Number of back-end SSLv3 sessions on the NetScaler appliance. TLSv1 sessions (BTLS1Se) Number of back-end TLSv1 sessions on the NetScaler appliance. Session multiplex attempts (BSeMx) Number of back-end SSL session multiplex attempts on the NetScaler appliance. Session multiplex successes (BSeMxS) Number of back-end SSL session multiplex successes on the NetScaler appliance. Session multiplex failures (BSeMxF) Number of back-end SSL session multiplex failures on the NetScaler appliance. Bytes encrypted (Enc) Number of bytes encrypted on the NetScaler appliance. Bytes decrypted (Dec) Number of bytes decrypted on the NetScaler appliance. SSL session renegotiations (SSLRn) Number of SSL session renegotiations on the NetScaler appliance. SSLv3 session renegotiations (SSL3Rn) Number of session renegotiations done on SSLv3. TLSv1 session renegotiations (TLS1Rn) Number of SSL session renegotiations done on TLSv1. RSA 512-bit key exchanges (RSAKx5) Number of RSA 512-bit key exchanges on the NetScaler appliance. RSA 1024-bit key exchanges (RSAKx1) Number of RSA 1024-bit key exchanges on the NetScaler appliance. RSA 2048-bit key exchanges (RSAKx2) Number of RSA 2048-bit key exchanges on the NetScaler appliance. RSA 4096-bit key exchanges (RSAKx4) Number of RSA 4096-bit key exchanges on the NetScaler appliance. DH 512-bit key exchanges (DHKx5) Number of Diffie-Helman 512-bit key exchanges on the NetScaler appliance. DH 1024-bit key exchanges (DHKx1) Number of Diffie-Helman 1024-bit key exchanges on the NetScaler appliance. DH 2048-bit key exchanges (DHKx2) Number of Diffie-Helman 2048-bit key exchanges on the NetScaler appliance. RC4 40-bit encryptions (RC4En4) Number of RC4 40-bit cipher encryptions on the NetScaler appliance. RC4 56-bit encryptions (RC4En5) Number of RC4 56-bit cipher encryptions on the NetScaler appliance. RC4 64-bit encryptions (RC4En6) Number of RC4 64-bit cipher encryptions on the NetScaler appliance. RC4 128-bit encryptions (RC4En1) Number of RC4 128-bit cipher encryptions on the NetScaler appliance. DES 40-bit encryptions (DESEn4)
Number of DES 40-bit cipher encryptions on the NetScaler appliance. DES 56-bit encryptions (DESEn5) Number of DES 56-bit cipher encryptions on the NetScaler appliance. 3DES 168-bit encryptions (3DESEn1) Number of DES 168-bit cipher encryptions on the NetScaler appliance. AES 128-bit encryptions (AESEn1) Number of AES 128-bit cipher encryptions on the NetScaler appliance. AES 256-bit encryptions (AESEn2) Number of AES 256-bit cipher encryptions on the NetScaler appliance. RC2 40-bit encryptions (RC2En4) Number of RC2 40-bit cipher encryptions on the NetScaler appliance. RC2 56-bit encryptions (RC2En5) Number of RC2 56-bit cipher encryptions on the NetScaler appliance. RC2 128-bit encryptions (RC2En1) Number of RC2 128-bit cipher encryptions on the NetScaler appliance. Null cipher encryptions (NullEn) Number of Null cipher encryptions on the NetScaler appliance. MD5 hashes (MD5Hsh) Number of MD5 hashes on the NetScaler appliance. SHA hashes (SHAHsh) Number of SHA hashes on the NetScaler appliance. SSLv2 SSL handshakes (SSL2Hs) Number of handshakes on SSLv2 on the NetScaler appliance. SSLv3 SSL handshakes (SSL3Hs) Number of handshakes on SSLv3 on the NetScaler appliance. TLSv1 SSL handshakes (TLS1Hs) Number of SSL handshakes on TLSv1 on the NetScaler appliance. SSLv2 client authentications (SSL2CAt) Number of client authentications done on SSLv2. SSLv3 client authentications (SSL3CAt) Number of client authentications done on SSLv3. TLSv1 client authentications (TLS1CAt) Number of client authentications done on TLSv1. RSA authentications (RSAAt) Number of RSA authentications on the NetScaler appliance. DH authentications (DHAt) Number of Diffie-Helman authentications on the NetScaler appliance. DSS (DSA) authentications (DSSAt) Total number of times DSS authorization is used on the NetScaler appliance. Null authentications (NullAt) Number of Null authentications on the NetScaler appliance. SSL session renegotiations (BSSLRn)
Number of back-end SSL session renegotiations on the NetScaler appliance. SSLv3 session renegotiations (BSSL3Rn) Number of back-end SSLv3 session renegotiations on the NetScaler appliance. TLSv1 session renegotiations (BTLS1Rn) Number of back-end TLSv1 session renegotiations on the NetScaler appliance. RSA 512-bit key exchanges (BRSAKx5) Number of back-end RSA 512-bit key exchanges on the NetScaler appliance. RSA 1024-bit key exchanges (BRSAKx1) Number of back-end RSA 1024-bit key exchanges on the NetScaler appliance. RSA 2048-bit key exchanges (BRSAKx2) Number of back-end RSA 2048-bit key exchanges on the NetScaler appliance. DH 512-bit key exchanges (BDHKx5) Number of back-end DH 512-bit key exchanges on the NetScaler appliance. DH 1024-bit key exchanges (BDHKx1) Number of back-end DH 1024-bit key exchanges on the NetScaler appliance. DH 2048-bit key exchanges (BDHKx2) Number of back-end DH 2048-bit key exchanges on the NetScaler appliance. RC4 40-bit encryptions (BRC4En4) Number of back-end RC4 40-bit cipher encryptions on the NetScaler appliance. RC4 56-bit encryptions (BRC4En5) Number of back-end RC4 56-bit cipher encryptions on the NetScaler appliance. RC4 64-bit encryptions (BRC4En6) Number of back-end RC4 64-bit cipher encryptions on the NetScaler appliance. RC4 128-bit encryptions (BRC4En1) Number of back-end RC4 128-bit cipher encryptions on the NetScaler appliance. DES 40-bit encryptions (BDESEn4) Number of back-end DES 40-bit cipher encryptions on the NetScaler appliance. DES 56-bit encryptions (BDESEn5) Number of back-end DES 56-bit cipher encryptions on the NetScaler appliance. 3DES 168-bit encryptions (B3DESE1n) Number of back-end 3DES 168-bit cipher encryptions on the NetScaler appliance. AES 128-bit encryptions (BAESEn1) Back-end AES 128-bit cipher encryptions on the NetScaler appliance. AES 256-bit encryptions (BAESEn2) Back-end AES 256-bit cipher encryptions on the NetScaler appliance. RC2 40-bit encryptions (BRC2En4) Number of back-end RC2 40-bit cipher encryptions on the NetScaler appliance. RC2 56-bit encryptions (BRC2En5) Number of back-end RC2 56-bit cipher encryptions on the NetScaler appliance. RC2 128-bit encryptions (BRC2En1) Number of back-end RC2 128-bit cipher encryptions on the NetScaler appliance. null encryptions (BNullEn)
Number of back-end null cipher encryptions on the NetScaler appliance. MD5 hashes (BMD5Hsh) Number of back-end MD5 hashes on the NetScaler appliance. SHA hashes (BSHAHsh) Number of back-end SHA hashes on the NetScaler appliance. SSLv3 handshakes (BSSL3Hs) Number of back-end SSLv3 handshakes on the NetScaler appliance. TLSv1 handshakes (BTLS1Hs) Number of back-end TLSv1 handshakes on the NetScaler appliance. SSLv3 client authentications (BSSL3CAt) Number of back-end SSLv3 client authentications on the NetScaler appliance. TLSv1 client authentications (BTLS1CAt) Number of back-end TLSv1 client authentications on the NetScaler appliance. RSA authentications (BRSAAt) Number of back-end RSA authentications on the NetScaler appliance. DH authentications (BDHAt) Number of back-end DH authentications on the NetScaler appliance. DSS authentications (BDSSAt) Number of back-end DSS authentications on the NetScaler appliance. Null authentications (BNullAt) Number of back-end null authentications on the NetScaler appliance. RSA key exchanges offloaded (RSAkxOf) Number of RSA key exchanges offloaded to the cryptography card. RSA sign operations offloaded (RSASnOf) Number of RSA sign operations offloaded to the cryptography card. DH key exchanges offloaded (DHkxOf) Number of DH key exchanges offloaded to the cryptography card.d RC4 encryptions offloaded (RC4EnOf) Number of RC4 encryptions offloaded to the cryptography card. DES encryptions offloaded (DESEnOf) Number of DES encryptions offloaded to the cryptography card. AES encryptions offloaded (AESEnOf) Number of AES encryptions offloaded to the cryptography card. Bytes encrypted in hardware (EncHw) Number of bytes encrypted in hardware. Bytes encrypted in software. (EncSw) Number of bytes encrypted in software. Bytes encrypted on the front end. (EncFe) Number of bytes encrypted on the front end. Bytes encrypted in hardware on the front end. (EncHwFe) Number of bytes encrypted in hardware on the front end. Bytes encrypted in software on front-end (EncSwFe)
Number of bytes encrypted in software on the front end. Bytes encrypted on back-end (EncBe) Number of bytes encrypted on the back end. Bytes encrypted in hardware on back-end (EncHwBe) Number of bytes encrypted in hardware on the back end. Bytes encrypted in software on back-end (EncSwBe) Number of bytes encrypted in software on the back end. Bytes decrypted in hardware (DecHw) Number of bytes decrypted in hardware. Bytes decrypted in software (DecSw) Number of bytes decrypted in software. Bytes decrypted on front-end (DecFe) Number of bytes decrypted on the front end. Bytes decrypted in hardware on front-end (DecHwFe) Number of bytes decrypted in hardware on the front end. Bytes decrypted in software on front-end (DecSwFe) Number of bytes decrypted in software on the front end. Bytes decrypted on back-end (DecBe) Number of bytes decrypted on the back end. Bytes decrypted in hardware on back-end (DecHwBe) Number of bytes decrypted in hardware on the back end. Bytes decrypted in software on the back end. (DecSwBe) Number of bytes decrypted in software on back-end Backend SSL sessions reused (BSeRe) Number of back-end SSL sessions reused on the NetScaler appliance. IDEA 128-bit encryptions (IDEAEn1) Number of IDEA 128-bit cipher encryptions on the NetScaler appliance. IDEA 128-bit encryptions (BIDEAEn1) Number of back-end IDEA 128-bit cipher encryptions on the NetScaler appliance. Example
Related Commands
create ssl fipsKey

Synopsis create ssl fipsKey <fipsKeyName> -modulus <positive_integer> [-exponent ( 3 | F4 )] Description Generate a FIPS key within the Hardware Security Module (HSM)-FIPS card. Arguments fipsKeyName The object name for the FIPS key.
modulus The modulus of the key to be created. The modulus value should be a multiple of 64. Minimum value: 1024 Maximum value: 4096 exponent The exponent value for the key to be created. 3 : Hex value 0x3 F4 : Hex value 0x10001 Possible values: 3, F4 Default value: 3 Example create fipskey fips1 -modulus 1024 -exp f4 Related Commands rm ssl fipsKey show ssl fipsKey import ssl fipsKey export ssl fipsKey
rm ssl fipsKey
Synopsis rm ssl fipsKey <fipsKeyName> ... Description Remove the specified FIPS key(s) from the system. Arguments fipsKeyName The name of the FIPS key(s) to be removed from the system. Example rm fipskey fips1 Related Commands create ssl fipsKey show ssl fipsKey import ssl fipsKey export ssl fipsKey
show ssl fipsKey

Synopsis show ssl fipsKey [<fipsKeyName>] Description Display the information on the FIPS keys configured on the system. If no FIPS key name is specified then the command will list all the FIPS keys configured in the system. If a FIPS key name is specified, the command will display the details of the FIPS key.
Arguments fipsKeyName The name of the FIPS key. summary fullValues format level modulus The modulus of the key. exponent The exponent value for the key. size Size. count stateflag Example 1) An example of output of show ssl fipskey command is as follows: show fipskey 2 FIPS keys: 1) FIPS Key Name: fips1 2) FIPS Key Name: fips2 2) An example of output of show fipskey command with FIPS key name specified is as follows: show fipskey fips1 FIPS Key Name: fips1 Modulus: 1024 Public Exponent: 3 (Hex: 0x3) Related Commands create ssl fipsKey rm ssl fipsKey import ssl fipsKey export ssl fipsKey
import ssl fipsKey

Synopsis import ssl fipsKey <fipsKeyName> -key <string> [-inform <inform>] [-wrapKeyName <string>] [-iv <string>] [exponent ( 3 | F4 )] Description Import a key into the Hardware Security Module (HSM) -FIPS card. You can also use this command to import a FIPS key from another System's FIPS system (example Primary system), or for importing a non-FIPS key from an external Web server (Apache/IIS). Arguments fipsKeyName The object name for the FIPS key being imported. key The path to the key file. The default input path for the key is /nsconfig/ssl/.
inform The input format of the key file. SIM: Secure Information Management. This is used when a FIPS key is transferred from one FIPS system to other. DER: Distinguished Encoding Rule. This is used when a non-FIPS key is to be imported inside a FIPS system. The non-FIPS key has to be converted to PKCS#8 form using the CLI command "convert pkcs8". Possible values: SIM, DER, PEM Default value: FORMAT_SIM wrapKeyName The object name of the wrapkey to use for importing the key. The wrapkey is created using the CLI command "create ssl wrapkey". This is required if the key being imported is a non-FIPS key. iv The Initialization Vector (IV) to use for importing the key. This is required if the key being imported is a non-FIPS key. exponent The exponent value for the key to be imported. 3 : Hex value 0x3 F4 : Hex value 0x10001 Possible values: 3, F4 Default value: 3 Example 1) import fipskey fips1 -key /nsconfig/ssl/fipskey.sim The above example imports a FIPS key stored in the file fipskey.sim in the system. 2) import fipskey fips2 -key /nsconfig/ssl/key.der inform DER -wrapKeyName wrapkey1 -iv wrap123 The above example imports a non-FIPS key stored in the file key.der in the system.
Related Commands create ssl fipsKey rm ssl fipsKey show ssl fipsKey export ssl fipsKey
export ssl fipsKey

Synopsis export ssl fipsKey <fipsKeyName> -key <string> Description Export a FIPS key from one system to another or to backup the FIPS key in a secure manner. The exported key is secured using a strong asymmetric key encryption methods. Arguments fipsKeyName The name of the FIPS key to be exported. key The path and file name to store the exported key. The default output path for the key is /nsconfig/ ssl/. Example export fipskey fips1 -key /nsconfig/ssl/fips1.key
Related Commands create ssl fipsKey rm ssl fipsKey show ssl fipsKey import ssl fipsKey
create ssl wrapkey

Synopsis create ssl wrapkey <wrapKeyName> {-password } {-salt } Description Generate a wrap key. Arguments wrapKeyName The object name for the wrap key. password The password string for the wrap key. salt The salt string for the wrap key. Example create wrapkey wrap1 -password wrapkey123 -salt wrapsalt123 Related Commands rm ssl wrapkey show ssl wrapkey
rm ssl wrapkey
Synopsis rm ssl wrapkey <wrapKeyName> ... Description Remove the specified wrapkey(s) from the system. Arguments wrapKeyName The name of the wrapkey(s) to be removed from the system. Example rm wrapkey wrap1 Related Commands create ssl wrapkey
show ssl wrapkey
show ssl wrapkey

Synopsis show ssl wrapkey Description Display the wrap keys. Arguments summary fullValues format level wrapKeyName Wrap key name. count stateflag Example An example of output of 'show wrapkey' command is as shown below: sh wrapkey 1 WRAP key: 1) WRAP Key Name: wrap1
Related Commands create ssl wrapkey rm ssl wrapkey
add ssl certKey

Synopsis add ssl certKey <certkeyName> -cert <string> [(-key <string> [-password]) | -fipsKey <string>] [-inform ( DER | PEM )] [-expiryMonitor ( ENABLED | DISABLED ) [-notificationPeriod <positive_integer>]] Description Add a certificate-key pair object. Notes: 1) For server certificate-key pair, use both -cert and -key arguments. 2) The command ###bind ssl certkey###, used for binding a certificate-key pair to an SSL virtual server, fails if the certificate-key pair does not include the private key. 3) In an HA configuration, the certificate should be located as specified in the -cert <string> parameter, on both the primary and secondary nodes. If the optional parameter -key is used, the key must be located as specified in the -key <string> parameter. Arguments certkeyName The name of the certificate and private-key pair.
cert The file name and path for the X509 certificate file. The certificate file should be present on the system device (HDD). The default input path for the certificate file is /nsconfig/ssl/. key The file name and path for the private-key file. The private-key file should be present on the system device (HDD). The default input path for the key file is /nsconfig/ssl/. Notes: 1) This argument is optional when adding a Certificate-Authority (CA) certificate file. In this case the CA's privatekey will not be available to the user. 2) The System's FIPS system does not support external keys (non-FIPS keys). On a System's FIPS system, you will not be able to load keys from a local storage device such as a hard disc or flash memory. fipsKey The name of the FIPS key. The FIPS key is created inside the FIPS HSM (Hardware Security Module). This is applicable only to the SSL FIPS system. inform The input format of the certificate and the private-key files. The two formats supported by the system are: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM passplain This is mostly used for API purpose.The pass-phrase that was used to encrypt the private-key. This option can be used to load encrypted private-keys. The maximum length of the pass-phrase supported is 32 characters. Note: Password protected private key is supported only for the PEM format. expiryMonitor Alert before the certificate is about to expire. Possible values: ENABLED, DISABLED notificationPeriod Number of days in advance when an alert needs to be generated for a certificate which is about to expire. Minimum value: 10 Maximum value: 100 Example 1) add ssl certkey siteAcertkey -cert /nsconfig/ssl/cert.pem -key /nsconfig/ssl/pkey.pem The above command loads a certificate and private key file. 2) add ssl certkey siteAcertkey -cert / nsconfig/ssl/cert.pem -key /nsconfig/ssl/pkey.pem -password Password: ******** The above command loads a certificate and private key file. Here the private key file is an encrypted key. 3) add ssl certkey fipscert -cert /nsconfig/ssl/cert.pem -fipskey fips1024 The above command loads a certificate and associates it with the corresponding FIPS key that resides within the HSM. Related Commands rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
rm ssl certKey
Synopsis rm ssl certKey <certkeyName> ... Description Remove the specified certificate-key pair from the system. Arguments certkeyName The name of the certificate-key pair. Note: The certificate-key pair is removed only when it is not referenced by any other object. The reference count is updated when the certificate-key pair is bound to an SSL virtual server (using the ###bind ssl certkey### command) or linked to another certificate-key pair (using the ###link ssl certkey### command). Example 1) rm ssl certkey siteAcertkey The above command removes the certificate-key pair siteAcertkey from the system. Related Commands add ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
set ssl certKey

Synopsis set ssl certKey <certkeyName> [-expiryMonitor ( ENABLED | DISABLED ) [-notificationPeriod <positive_integer>]] Description Change attributes of a certificate-key pair object. Arguments certkeyName The name of the certificate and private-key pair. expiryMonitor Alert before the certificate is about to expire. Possible values: ENABLED, DISABLED Example
Related Commands add ssl certKey rm ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
unset ssl certKey

Synopsis unset ssl certKey <certkeyName> [-expiryMonitor] [-notificationPeriod] Description Use this command to remove ssl certKey settings.Refer to the set ssl certKey command for meanings of the arguments. Arguments Example
Related Commands add ssl certKey rm ssl certKey set ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
bind ssl certKey

Synopsis bind ssl certKey [<certkeyName>] [-ocspResponder <string>] [-priority <positive_integer>] Description Bind a certificate-key pair to an SSL virtual server or an SSL service
Arguments certkeyName The object name for the certificate-key pair. ocspResponder The name of the OCSP responder to be associated with the CA certificate. vServerName The name of the SSL virtual server name to which the certificate-key pair needs to be bound. serviceName The name of the SSL service to which the certificate-key pair needs to be bound. Use the ###add service### command to create this service. serviceGroupName The name of the SSL service group to which the certificate-key pair needs to be bound. Use the "add servicegroup" command to create this service. CA If this option is specified, it indicates that the certificate-key pair being bound to the SSL virtual server is a CA certificate. If this option is not specified, the certificate-key pair is bound as a normal server certificate. Note: In case of a normal server certificate, the certificate-key pair should consist of both the certificate and the private-key. Example 1) bind ssl certkey cacert -ocspResponder ocsp_ca -priority 1 In the above example, the CA certificate cacert is bound with the OCSP responder ocsp_ca with priority 1, which is highest.
Related Commands add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
unbind ssl certKey

Synopsis unbind ssl certKey <certkeyName> -ocspResponder <string> Description Unbind the certificate-key pair from the specified SSL vserver or SSL service. Use the "bind ssl certkey " command to bind the certificate-key pair to the specified SSL vserver or SSL service. Arguments certkeyName
The object name for the certificate-key pair. ocspResponder OCSP responders bound to this certkey vServerName The name of the SSL virtual server. serviceName The name of the SSL service serviceGroupName The name of the service group. CA The certificate-key pair being unbound is a Certificate Authority (CA) certificate. If you choose this option, the certificate-key pair is unbound from the list of CA certificates that were bound to the specified SSL virtual server or SSL service. Example 1) unbind ssl certkey sslvip siteAcertkey In the above example, the server certificate siteAcertkey is unbound from the SSL virtual server. 2) unbind ssl certkey sslvip CAcertkey -CA In the above example, the CA certificate CAcertkey is unbound from the SSL virtual server. Related Commands add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
link ssl certKey

Synopsis link ssl certKey <certkeyName> <linkCertKeyName> Description Link a certificate-key pair to its Certificate Authority (CA) certificate-key pair. Note: The two certificate-key pairs are linked only if the certificate specified in the certKeyName parameter is issued by the Certificate-Authority specified in the linkCertKeyName parameter. Arguments certkeyName The certificate-key name that is to be bound to its issuer certificate-key pair. linkCertKeyName The name of the Certificate-Authority.
Example 1) link ssl certkey siteAcertkey CAcertkey In the above example, the certificate-key siteAcertkey is bound to its issuer certificate-key pair CAcertkey. Related Commands add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey unlink ssl certKey show ssl certKey update ssl certKey
unlink ssl certKey

Synopsis unlink ssl certKey <certkeyName> Description Unlink the certificate-key name from its Certificate-Authority (CA) certificate-key pair. Arguments certkeyName The certificate-key object name that has to be unlinked from the CA certificate. The CA certificate name is taken internally. Example 1) unlink ssl certkey siteAcertkey The above example unlinks the certificate 'siteAcertkey' from its Certificate-Authority (CA) certificate. Related Commands add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey show ssl certKey update ssl certKey
show ssl certKey

Synopsis show ssl certKey [<certkeyName>] Description Display the information pertaining to the certificate-key pairs configured on the system: 1) If no argument is specified, the command will display all the certificate-key pairs configured on the system. 2) If the certKeyName argument is specified, the command will display the details of the certificate. Arguments certkeyName The certificate-key pair object name. summary fullValues format level cert The name and location of the file containing the certificate. key The name and location of the file containing the key. inform The encoding format of the certificate and key (PEM or DER). signatureAlg Signature algorithm. serial Serial number. issuer Issuer name. clientCertNotBefore Not-Before date. clientCertNotAfter Not-After date. daysToExpiration Days remaining for the certificate to expire. subject Subject name. publickey Public key algorithm. publickeysize Size of the public key. version Version.
priority ocsp priority status Status of the certificate. fipsKey FIPS key ID. passcrypt Passcrypt. data Vserver Id serverName Vserver name to which the certificate key pair is bound. serviceName Service name to which the certificate key pair is bound. ocspResponder OCSP responders bound to this certkey expiryMonitor Certificate expiry monitor notificationPeriod Certificate expiry notification period stateflag count Example 1) An example of the output of the show ssl certkey command is shown below: 2 configured certkeys: 1) Name: siteAcertkey Cert Path: /nsconfig/ssl/siteA-cert.pem Key Path: /nsconfig/ ssl/siteA-key.pem Format: PEM Status: Valid 2) Name: cert1 Cert Path: /nsconfig/ssl/ server_cert.pem Key Path: /nsconfig/ssl/server_key.pem Format: PEM Status: Valid 2) An example of the output of the show ssl certkey siteAcertkey command is shown below: Name: siteAcertkey Status: Valid Version: 3 Serial Number: 02 Signature Algorithm: md5WithRSAEncryption Issuer: /C=US/ST=CA/L=Santa Clara/O=siteA/OU=Tech Validity Not Before: Nov 11 14:58:18 2001 GMT Not After: Aug 7 14:58:18 2004 GMT Subject: /C=US/ ST-CA/L=San Jose/O=CA/OU=Security Public Key Algorithm: rsaEncryption Public Key size: 1024 Related Commands add ssl certKey rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey
update ssl certKey
update ssl certKey

Synopsis update ssl certKey <certkeyName> [-cert <string>] [(-key <string> [-password]) | -fipsKey <string>] [-inform ( DER | PEM )] [-noDomainCheck] Description Update a certificate-key pair object. Notes: 1) In a HA configuration, the certificate should be located as specified in the -cert <string> parameter, on both the primary and secondary nodes. If the optional parameter -key is used, the key must be located as specified in the -key <string> parameter. Arguments certkeyName The name of the certificate and private-key pair. cert The file name and path for the X509 certificate file. The certificate file should be present on the system device (HDD). The default input path for the certificate file is /nsconfig/ssl/. key The file name and path for the private-key file. The private-key file should be present on the system device (HDD). The default input path for the key file is /nsconfig/ssl/. fipsKey The name of the FIPS key. The FIPS key is created inside the FIPS HSM (Hardware Security Module). This is applicable only to the SSL FIPS system. inform The input format of the certificate and the private-key files. The two formats supported by the system are: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM passplain This is mostly used for API purpose.The pass-phrase that was used to encrypt the private-key. This option can be used to load encrypted private-keys. The maximum length of the pass-phrase supported is 32 characters. Note: Password protected private key is supported only for the PEM format. noDomainCheck Specify this option to override the check for matching domain names during certificate update operation Example 1) update ssl certkey siteAcertkey -cert /nsconfig/ssl/cert.pem -key /nsconfig/ssl/pkey.pem The above command updates a certificate and private key file. 2) update ssl certkey siteAcertkey -cert /nsconfig/ssl/cert.pem -key /nsconfig/ssl/pkey.pem -password Password: ******** The above command updates a certificate and private key file. Here the private key file is an encrypted key. 3) update ssl certkey mydomaincert The above command updates the certificate using the same parameters (-cert path/-key path) that it was added with. Related Commands add ssl certkey rm ssl certkey add ssl certKey
rm ssl certKey set ssl certKey unset ssl certKey bind ssl certKey unbind ssl certKey link ssl certKey unlink ssl certKey show ssl certKey
add ssl cipher

Synopsis add ssl cipher <cipherGroupName> <cipherAliasName/cipherName/cipherGroupName> ... Description Create a user-defined cipher group or to add ciphers to an existing group. The cipher group can be used to set the cipher-suite of an SSL virtual server. Arguments cipherGroupName The name of the user-defined cipher group. If the cipher group does not exist on the system, a new group is created with the specified name. The ciphers are added to this group. If a group identified by cipherGroupName already exists on the system, the ciphers are added to it. cipherAliasName/cipherName/cipherGroupName The individual cipher name(s), a user-defined cipher group, or a system predefined cipher alias that will be added to the predefined cipher alias that will be added to the group cipherGroupName. If a cipher alias or a cipher group is specified, all the individual ciphers in the cipher alias or group will be added to the user-defined cipher group. Example 1) add ssl cipher mygroup SSL2-RC4-MD5 SSL2-EXP-RC4-MD5 The above command creates a new cipher-group by the name: mygroup, with the two ciphers SSL2-RC4-MD5 and SSL2EXP-RC4-MD5, as part of the cipher-group. If a cipher-group by the name: mygroup already exists in system, then the two ciphers is added to the list of ciphers contained in the group. 2) add ssl cipher mygroup HIGH MEDIUM The above command creates a new cipher-group by the name: mygroup, with the ciphers from the cipher alias "HIGH" and "MEDIUM" as part of the cipher group. If a cipher-group by the name, mygroup, already exists in system, then the ciphers from the two aliases is added to the list of ciphers contained in the group. Related Commands bind ssl cipher show ssl cipher rm ssl cipher
bind ssl cipher

Synopsis bind ssl cipher (<vServerName>@ | <serviceName>@ | <serviceGroupName>@) [-vServer | -service | servicegroup] <cipherOperation> <cipherAliasName/cipherName/cipherGroupName>
Description Change the default cipher-suite defined for an SSL virtual server. By default, the predefined cipher alias on the system is bound to all SSL virtual servers. The DEFAULT alias contains all ciphers with encryption strength >=128bit. Note: To view the individual ciphers in the alias DEFAULT, use the show ssl cipher DEFAULT CLI command Arguments vServerName The name of the SSL virtual server to which the cipher-suite is to be bound. serviceName The name of the SSL service name to which the cipher-suite is to be bound. serviceGroupName The name of the SSL service name to which the cipher-suite is to be bound. cipherOperation The operation that is performed when adding the cipher-suite. Possible cipher operations are: ADD - Appends the given cipher-suite to the existing one configured for the virtual server. REM - Removes the given cipher-suite from the existing one configured for the virtual server. ORD Overrides the current configured cipher-suite for the virtual server with the given cipher-suite. Possible values: ADD, REM, ORD cipherAliasName/cipherName/cipherGroupName A cipher-suite can consist of an individual cipher name, the system predefined cipher-alias name, or user defined cipher-group name. Example 1) bind ssl cipher sslvip ADD SSL3-RC4-SHA The above example appends the cipher SSL3RC4-SHA to the cipher-suite already configured for the SSL virtual server sslvip. 2) bind ssl cipher sslvip REM NULL The above example removes the ciphers identified by the system's predefined cipher-alias -NULL from the cipher-suite already configured for the SSL virtual server sslvip. 3) bind ssl cipher sslvip ORD HIGH The above example overrides the existing cipher-suite configured for the SSL virtual server with ciphers, having HIGH encryption strength (ciphers supporting 168-bit encryption). Note: The individual ciphers contained in a system predefined cipher-alias can beviewed by using the following command: show ssl cipher <cipherAlaisName>
Related Commands add ssl cipher show ssl cipher rm ssl cipher
show ssl cipher

Synopsis show ssl cipher [<cipherAliasName/cipherName/cipherGroupName>] Description Display the details of a cipher, cipher-group, or cipher-alias defined on the system. If no argument is specified, the command displays all the predefined cipher-aliases and user-defined cipher-groups on the system. If a cipher name is specified, the details of the cipher are displayed. If a user defined cipher-group name is specified, all the individual
ciphers in the group are displayed along with the individual cipher description. If a system predefined cipher-alias name is specified, all the individual ciphers in the alias are displayed along with the individual cipher description. Arguments cipherAliasName/cipherName/cipherGroupName cipherName: The individual cipher name. cipherGroupName: The user defined cipher-group name for which the cipher details are displayed. cipherAliasName: The system predefined cipher-alias name for which the cipher details aredisplayed. summary fullValues format level cipherGroupName The name of cipher group/alias/individual cipher name. description Cipher suite description. cipherName Cipher name. flag stateflag count Example 1) An example of the output of the show ssl cipher SSL3-RC4-MD5 command is as follows: Cipher Name: SSL3-RC4-MD5 Description: SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2) This example displays the details of individual ciphers in the system predefinedcipher-alias: SSLv2 (the command show ssl cipher SSLv2 has been entered): 8 configured cipher(s)in alias 1) Cipher Name: SSL2-RC4-MD5 Description: SSLv2 Kx=RSA Au=RSA Enc=RC4(128) Mac=MD5 2) Cipher Name: SSL2-EXP-RC4-MD5 Description: SSLv2 Kx=RSA(512) Au=RSA Enc=RC4(40) Mac=MD5 export 3) Cipher Name: SSL2RC2-CBC-MD5 Description: SSLv2 Kx=RSA Au=RSA Enc=RC2(128) Mac=MD5 4) Cipher Name: SSL2-EXP-RC2-CBC-MD5 Description: SSLv2 Kx=RSA(512) Au=RSA Enc=RC2(40) Mac=MD5 export 5) Cipher Name: SSL2-DES-CBC-MD5 Description: SSLv2 Kx=RSA Au=RSA Enc=DES(56) Mac=MD5 6) Cipher Name: SSL2-DES-CBC3-MD5 Description: SSLv2 Kx=RSA Au=RSA Enc=3DES(168) Mac=MD5 7) Cipher Name: SSL2-RC4-64-MD5 Description: SSLv2 Kx=RSA Au=RSA Enc=RC4(64) Mac=MD5 Related Commands add ssl cipher bind ssl cipher rm ssl cipher
rm ssl cipher
Synopsis rm ssl cipher <cipherGroupName> [<cipherName> ...]
Description Remove cipher(s) from a user-defined cipher group. It can also remove an entire cipher group from the system. If there is no cipherName included with the cipherGroupName, the cipher group specified by cipherGroupName is deleted. If there is a cipherName included, the specified cipher(s) are removed from the cipher group. Arguments cipherGroupName The user defined cipher group on the system. cipherName The cipher(s) to be removed from the cipher group. Example 1) rm ssl cipher mygroup SSL2-RC4-MD5 The above example removes the cipher SSL2-RC4MD5 from the cipher group mygroup. 2) rm ssl cipher mygroup The above example will remove the cipher group 'mygroup' from the system. Related Commands add ssl cipher bind ssl cipher show ssl cipher
add ssl crl

Synopsis add ssl crl <crlName> <crlPath> [-inform ( DER | PEM )] [-refresh ( ENABLED | DISABLED )] [-CAcert <string>] [-method ( HTTP | LDAP )] [-server <ip_addr|ipv6_addr|*> | -url <URL>] [-port <port>] [-baseDN <string>] [-scope ( Base | One )] [-interval <interval>] [-day <integer>] [-time <HH:MM>] [-bindDN <string>] {-password } [-binary ( YES | NO )] Description Add a Certificate Revocation List (CRL) object. Note: In an HA configuration, the CRL on both the primary and secondary nodes must be present in the location specified by <crlPath>. Arguments crlName The object name for the CRL. crlPath The file name and path for the CRL file. The default input path for the CRL is /var/netscaler/ssl/. inform The input format of the CRL file. PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM refresh Enables or disables the auto refresh feature for the CRL identified by the crlName Possible values: ENABLED, DISABLED CAcert The corresponding CA certificate that has issued the CRL. This is the System object identifying the CA certificate that is loaded in System. Note: This is a mandatory field when the "-refresh" option is enabled. The CA certificate needs to be installed before loading the CRL. method The method for CRL refresh - HTTP or LDAP. Possible values: HTTP, LDAP Default value: MTHD_LDAP
server The IP address of the LDAP server from which the CRLs are to be fetched. url URI of the CRL Distribution Point. port The port for the LDAP server. Minimum value: 1 baseDN The baseDN attribute used by LDAP search to query for the attribute certificateRevocationList. Note: It is recommended to use the baseDN attribute over the Issuer Name from the CA certificate for the CRL, if the Issuer-Name fields does not exactly match the LDAP directory structure's DN. scope Extent of the search operation on the LDAP server. Base: Exactly the same level as basedn One : One level below basedn Possible values: Base, One Default value: NSAPI_ONESCOPE interval The CRL refresh interval. The valid values are monthly, weekly, and daily. This along with the days and -time option will identify the exact time/time-interval for CRL refresh. -interval NONE can be used to reset previously set interval settings. Possible values: MONTHLY, WEEKLY, DAILY, NONE day The purpose of this option varies with the usage of the -interval option. If the -interval option has been set to MONTHLY, the -days option can be used to set a particular day of the month (1-30/31/28) on which the CRL needs to be refreshed. If the -interval option has been set to WEEKLY, the -days option can be used to set a particular day of the week, i.e. 1...7 (Sun=1,Sat=7) on which the CRL needs to be refreshed. The system handles the valid number of days in a Month or Week, if the input value for the corresponding -day option is set incorrectly. If the -interval option has been set to DAILY, the -days parameter is not used. If the -days option is used without the -interval option, it specifies the number of days after which the refresh is to be done. Maximum value: 31 time The exact time of the day when the CRL is to be refreshed. The time is specified in 24-hour time format, where HH stands for Hours and MM stands for minutes. bindDN The bindDN to be used to access the CRL object in the LDAP repository. This is required if the access to the LDAP repository is restricted, i.e. anonymous access is not allowed. password The password to be used to access the CRL object in the LDAP repository. This is required if the access to the LDAP repository is restricted i.e. anonymous access is not allowed. binary Set the LDAP based CRL retrieval mode to binary. Possible values: YES, NO Default value: NO Example 1) add ssl certkey CAcert -cert /nsconfig/ssl/ca_cert.pem add ssl crl crl_file /var/netscaler/ssl/ crl.pem -cacert CAcert The above command adds a CRL from local storage system (HDD) with no refresh set. 2) add ssl certkey CAcert -cert /nsconfig/ssl/ca_cert.pem add ssl crl crl_file /var/ netscaler/ssl/crl_new.pem -cacert Cacert -refresh ENABLED -server 10.102.1.100 -port 389 interval DAILY -baseDN o=example.com,ou=security,c=US The above command adds a CRL to the system by fetching the CRL from the LDAP server and setting the refresh interval as daily.
Related Commands create ssl crl rm ssl crl set ssl crl unset ssl crl show ssl crl
create ssl crl

Synopsis create ssl crl <CAcertFile> <CAkeyFile> <indexFile> (-revoke <input_filename> | -genCRL <output_filename>) {password } Description Revoke a certificate or list of certificates or generate a CRL for the list of certificates that are revoked. Arguments CAcertFile Path to the CA certificate file. The default input path for the CA certificate is /nsconfig/ssl/. Maximum value: 63 CAkeyFile Path to the CA key file. The default input path for the CA key is /nsconfig/ssl/. Maximum value: 63 indexFile This file contains the serial number of all the certificates that are revoked. This file is created the first time. New certificate revocation will be added to it subsequently. The default input path for the index file is /nsconfig/ssl/. Maximum value: 63 revoke The certificate file to be revoked. The default input path for the certificate(s) is /nsconfig/ssl/. Maximum value: 63 genCRL The CRL file to be created. The list of certificates that have been revoked is obtained from the index file. The default output path for the CRL file is /var/netscaler/ssl/. Maximum value: 63 password The password for the CA key file. Maximum value: 31 Example 1) create crl /nsconfig/ssl/cacert.pem /nsconfig/ssl/cakey.pem /nsconfig/ssl/index.txt -gencrl /var/ netscaler/ssl/crl.pem Related Commands add ssl crl rm ssl crl set ssl crl unset ssl crl show ssl crl
rm ssl crl
Synopsis rm ssl crl <crlName> ... Description Remove the specified CRL object from the system. Arguments crlName The name of the CRL object to be removed from the system. Example 1) rm ssl crl ca_crl The above CLI command to delete the CRL object ca_crl from the system is. Related Commands add ssl crl create ssl crl set ssl crl unset ssl crl show ssl crl
set ssl crl

Synopsis set ssl crl <crlName> [-refresh ( ENABLED | DISABLED )] [-CAcert <string>] [-server <ip_addr|ipv6_addr|*> | -url <URL>] [-method ( HTTP | LDAP )] [-port <port>] [-baseDN <string>] [-scope ( Base | One )] [-interval <interval>] [-day <integer>] [-time <HH:MM>] [-bindDN <string>] {-password } [-binary ( YES | NO )] Description Enable the automatic refresh option on a CRL and set different refresh parameters. Arguments crlName The object name for the CRL. refresh The state of the auto refresh feature for the CRL. Possible values: ENABLED, DISABLED CAcert The corresponding CA certificate that has issued the CRL. This is the System object identifying the CA certificate that is loaded in System. server The IP address of the LDAP server from which the CRLs are to be fetched. method The method for CRL refresh. Possible values: HTTP, LDAP Default value: MTHD_LDAP port The port of the LDAP server. Minimum value: 1 baseDN
The baseDN attribute used by LDAP search to query for the attribute certificateRevocationList. Note: It is recommended to use the baseDN attribute over the Issuer Name from the CA certificate for the CRL, if the Issuer-Name fields does not exactly match the LDAP directory structure's DN. scope Extent of the search operation on the LDAP server. Base: Exactly the same level as basedn One : One level below basedn Possible values: Base, One Default value: NSAPI_ONESCOPE interval The CRL refresh interval. This option, when used in conjunction with the -days and -time option, can identify the exact time/time-interval for the CRL refresh. -interval NONE can be used to reset previously set interval settings. -interval NOW can be used to force a instantaneous CRL refresh. This is a one time operation. Possible values: MONTHLY, WEEKLY, DAILY, NOW, NONE day The purpose of this option varies with the usage of the -interval option. If the -interval option has been set to MONTHLY, the -days option can be used to set a particular day of the month (1-30/31/28) on which the CRL needs to be refreshed. If the -interval option has been set to WEEKLY, the -days option can be used to set a particular day of the week, i.e. 1...7 (Sun=1,Sat=7) on which the CRL needs to be refreshed. Sytem handles the valid number of days in a Month or Week, if the input value for the corresponding -day option is set incorrectly. For -interval daily, the -days parameter is not used. If -days is used without the -interval option, it specifies the number of days after which the refresh is to be performed. Maximum value: 31 time The exact time of the day when the CRL is to be refreshed. The time is specified in 24-hour time format, where HH stands for Hours and MM stands for minutes. bindDN The bindDN to be used to access the CRL object in the LDAP repository. This is required if the access to the LDAP repository is restricted, i.e. anonymous access is not allowed. password The password to be is used to access the CRL object in the LDAP repository. This is required if the access to the LDAP repository is restricted, i.e. anonymous access is not allowed. binary Set the LDAP based CRL retrieval mode to binary. Possible values: YES, NO Default value: NO Example 1) set ssl crl crl_file -refresh ENABLE -interval MONTHLY -days 10 -time 12:00 The above example sets the CRL refresh to every Month, on date=10, and time=12:00hrs. 2) set ssl crl crl_file -refresh ENABLE -interval WEEKLY -days 1 -time 00:10 The above example sets the CRL refresh every Week, on weekday=Sunday, and at time 10 past midnight. 3) set ssl crl crl_file -refresh ENABLE -interval DAILY -days 1 -time 12:00 The above example sets the CRL refresh every Day, at 12:00hrs. 4) set ssl crl crl_file -refresh ENABLE -days 10 The above example sets the CRL refresh after every 10 days. Note: The CRL will be refreshed after every 10 days. The time for CRL refresh will be 00:00 hrs. 5) set ssl crl crl_file -refresh ENABLE time 01:00 The above example sets the CRL refresh after every 1 hour. 6) set ssl crl crl_file refresh ENABLE -interval NOW The above example sets the CRL refresh instantaneously. Related Commands add ssl crl create ssl crl rm ssl crl unset ssl crl
show ssl crl
unset ssl crl

Synopsis unset ssl crl <crlName> [-refresh] [-CAcert] [-server] [-method] [-url] [-port] [-baseDN] [-scope] [-interval] [-day] [time] [-bindDN] [-password] [-binary] Description Use this command to remove ssl crl settings.Refer to the set ssl crl command for meanings of the arguments. Arguments Example Related Commands add ssl crl create ssl crl rm ssl crl set ssl crl show ssl crl
show ssl crl

Synopsis show ssl crl [<crlName>] Description Display the information pertaining to the Certificate Revocation Lists (CRL) configured on the system: If the crlName argument is specified, the command displays the details of the CRL. If the crlName argument is not specified, the command displays all the CRLs. Arguments crlName The CRL object name. summary fullValues format level crlPath The name and path to the file containing the CRL. inform The encoding format of the CRL (PEM or DER). CAcert The CA certificate that issued the CRL. refresh The state of the auto refresh feature for the CRL. scope
Extent of the search operation on the LDAP server. Base: Exactly the same level as basedn One : One level below basedn. server The IP address of the LDAP/HTTP server from which the CRLs are to be fetched. port The port of the LDAP/HTTP server. url URI of the CRL Distribution Point. method The method for CRL refresh (LDAP or HTTP). baseDN The baseDN to be used to fetch the CRL object from the LDAP server. interval The CRL refresh interval. day The day when the CRL is to be refreshed. time The time when the CRL is to be refreshed. bindDN The bindDN to be used to access the CRL object in the LDAP repository. password The password to be is used to access the CRL object in the LDAP repository. flags CRL status flag. lastupdatetime Last CRL refresh time. version CRL version. signaturealgo Signature algorithm. issuer Issuer name. lastupdate Last update time. nextupdate Next update time. date Certificate Revocation date number Certificate Serial number. binary Mode of retrieval of CRL from LDAP server.
daysToExpiration Number of days remaining for the CRL to expire. count stateflag Example 1) An example output of the show ssl crl command is as follows: 1 configured CRL(s) 1 Name: ca_crl CRL Path: /var/netscaler/ssl/cr1.der Format: DER Cacert: ca_cert Refresh: DISABLED 2) An example of the output of the show ssl crl ca_crl command is as follows: Name: ca_crl Status: Valid, Days to expiration: 21 CRL Path: /var/netscaler/ssl/cr1.der Format: DER CAcert: ca_cert Refresh: DISABLED Version: 1 Signature Algorithm: md5WithRSAEncryption Issuer: / C=US/ST=CA/L=santa clara /O=CA/OU=security Last_update:Dec 21 09:47:16 2001 GMT Next_update:Jan 20 09:47:16 2002 GMT Revoked Certificates: Serial Number: 01 Revocation Date:Dec 21 09:47:02 2001 GMT Serial Number: 02 Revocation Date:Dec 21 09:47:02 2001 GMT Related Commands add ssl crl create ssl crl rm ssl crl set ssl crl unset ssl crl
add ssl action

Synopsis add ssl action <name> [-clientAuth ( DOCLIENTAUTH | NOCLIENTAUTH )] [-clientCert ( ENABLED | DISABLED ) -certHeader <string>] [-clientCertSerialNumber ( ENABLED | DISABLED ) -certSerialHeader <string>] [-clientCertSubject ( ENABLED | DISABLED ) -certSubjectHeader <string>] [-clientCertHash ( ENABLED | DISABLED ) -certHashHeader <string>] [-clientCertIssuer ( ENABLED | DISABLED ) certIssuerHeader <string>] [-sessionID ( ENABLED | DISABLED ) -sessionIDHeader <string>] [-cipher ( ENABLED | DISABLED ) -cipherHeader <string>] [-clientCertNotBefore ( ENABLED | DISABLED ) certNotBeforeHeader <string>] [-clientCertNotAfter ( ENABLED | DISABLED ) -certNotAfterHeader <string>] [OWASupport ( ENABLED | DISABLED )] Description Create a new SSL action. Arguments name The name for the new SSL action. clientAuth Set action to do client certificate authentication or no authentication. DOCLIENTAUTH: Perform client certificate authentication. NOCLIENTAUTH: No client certificate authentication. Possible values: DOCLIENTAUTH, NOCLIENTAUTH clientCert The state of insertion of the client certificate in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED clientCertSerialNumber
The state of insertion of the client certificate's Serial Number in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED clientCertSubject The state of insertion of the client certificate's Subject Name in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED clientCertHash The state of insertion of the client certificate's hash (signature) in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED clientCertIssuer The state of insertion of the client certificate's Issuer Name in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED sessionID The state of insertion of the Session-ID in the HTTP header when the request is sent to the webserver. Possible values: ENABLED, DISABLED cipher The state of insertion of the cipher details in the HTTP header when the request is sent to the webserver. Possible values: ENABLED, DISABLED clientCertNotBefore The state of insertion of the client certificate's Not-Before date in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED clientCertNotAfter The state of insertion of the client certificate's Not-After in the HTTP header when the request is sent to the web-server. Possible values: ENABLED, DISABLED OWASupport The state of Outlook Web-Access support. If the system is in front of an Outlook Web Access (OWA) server, a special header field, 'FRONT-END-HTTPS: ON', needs to be inserted in the HTTP requests going to the OWA server. Note: This parameter is required as the SSL requests (HTTPS) arrives at the back-end Exchange-2000 server on the configured HTTP port (80) instead of arriving at the front-end Exchange 2000 server. Possible values: ENABLED, DISABLED Example add ssl action certInsert_act -clientCert ENABLED -certHeader CERT Related Commands rm ssl action show ssl action
rm ssl action
Synopsis rm ssl action <name> Description Remove the specified SSL action. Arguments name The name of the SSL action.
Example rm ssl action certInsert_act Related Commands add ssl action show ssl action
show ssl action

Synopsis show ssl action [<name>] Description Display the SSL actions. Arguments name The name of the SSL action. summary fullValues format level stateflag clientAuth Set action to do client certificate authentication or no authentication. DOCLIENTAUTH: Perform client certificate authentication. NOCLIENTAUTH: No client certificate authentication. clientCert The state of insertion of the client certificate in the HTTP header when the request is sent to the web-server. certHeader clientCertSerialNumber The state of insertion of the client certificate's Serial Number in the HTTP header when the request is sent to the web-server. certSerialHeader clientCertSubject The state of insertion of the client certificate's Subject Name in the HTTP header when the request is sent to the web-server. certSubjectHeader clientCertHash The state of insertion of the client certificate's hash (signature) in the HTTP header when the request is sent to the web-server. certHashHeader clientCertIssuer
The state of insertion of the client certificate's Issuer Name in the HTTP header when the request is sent to the web-server. certIssuerHeader sessionID The state of insertion of the Session-ID in the HTTP header when the request is sent to the webserver. sessionIDHeader cipher The state of insertion of the cipher details in the HTTP header when the request is sent to the webserver. cipherHeader OWASupport The state of Outlook Web-Access support. If the system is in front of an Outlook Web Access (OWA) server, a special header field, 'FRONT-END-HTTPS: ON', needs to be inserted in the HTTP requests going to the OWA server. Note: This parameter is required as the SSL requests (HTTPS) arrives at the back-end Exchange-2000 server on the configured HTTP port (80) instead of arriving at the front-end Exchange 2000 server. clientCertNotBefore The state of insertion of the client certificate's Not-Before date in the HTTP header when the request is sent to the web-server. certNotBeforeHeader clientCertNotAfter The state of insertion of the client certificate's Not-After in the HTTP header when the request is sent to the web-server. certNotAfterHeader hits The number of times the action has been taken. undefHits The number of times the action resulted in UNDEF. referenceCount The number of references to the action. description Description of the action flags count Example show ssl action 1 Configured SSL action: 1) Name: certInsert_act Data Insertion Action: Cert Header: ENABLED Cert Tag: CERT
Related Commands add ssl action rm ssl action
add ssl policy

Synopsis add ssl policy <name> -rule <expression> [-action <string>] [-undefAction <string>] [-comment <string>] Description Add an SSL policy. Arguments name The name for the new SSL policy. rule The expression that sets the condition for application of the SSL policy. reqAction The name of the action to be performed on the request. Refer to 'add ssl action' command to add a new action. Builtin actions like NOOP, RESET, DROP, CLIENTAUTH and NOCLIENTAUTH are also allowed. action Rewrite action to be used by the policy. undefAction Action to be used by the policy when the rule evaluation turns out to be undefined. The undef action can be NOOP, RESET or DROP comment Comments associated with this policy. Example add ssl action certInsert_act -clientCert ENABLED -certHeader CERT add ssl policy certInsert_pol -rule 'HTTP.REQ.URL.STARTSWITH("/secure/")' -reqAction certInsert_act The above example adds an SSL policy to do Client certificate insertion into the HTTP requests for any web-objects under /secure/. Related Commands rm ssl policy set ssl policy unset ssl policy show ssl policy
rm ssl policy
Synopsis rm ssl policy <name> Description Remove an SSL policy. Arguments name The name of the SSL policy.
Example rm ssl policy certInsert_pol Related Commands add ssl policy set ssl policy unset ssl policy show ssl policy
set ssl policy

Synopsis set ssl policy <name> [-rule <expression>] [-action <string>] [-undefAction <string>] [-comment <string>] Description Set a new rule/action/undefAction for existing SSL policy. The rule flow type can change only if: . action and undefAction(if present) are of NEUTRAL flow type Arguments name Name of the SSL policy rule Expression to be used by SSL policy. It has to be a boolean PI rule expression. action Rewrite action to be used by the policy. undefAction A SSL action, to be used by the policy when the rule evaluation turns out to be undefined. The undef action can be NOREWRITE, RESET or DROP comment Comments associated with this SSL policy. Example set ssl policy pol1 -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh2\\")" Related Commands add ssl policy rm ssl policy unset ssl policy show ssl policy
unset ssl policy

Synopsis unset ssl policy <name> [-undefAction] [-comment]
Description Unset ssl policy arguments.Refer to the set ssl policy command for meanings of the arguments. Arguments Example unset ssl policy pol1 -undefAction Related Commands add ssl policy rm ssl policy set ssl policy show ssl policy
show ssl policy

Synopsis show ssl policy [<name>] Description Display the created SSL policies. Arguments name The name of the SSL policy. summary fullValues format level stateflag rule The expression that sets the condition for application of the SSL policy. action The name of the action to be performed on the request. undefAction Undef Action associated with the policy. hits Number of hits for this policy. piHits Number of hits. undefHits Number of Undef hits. activePolicy
boundTo The entity name to which policy is bound priority gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policy comment Comments associated with this policy. bindPolicyType vserverType policyType count Example show ssl policy 1 SSL policy: 1) Name: certInsert_pol Rule: URL == /* Action: certInsert_act Hits: 0 Related Commands add ssl policy rm ssl policy set ssl policy unset ssl policy
add ssl policylabel

Synopsis add ssl policylabel <labelName> -type ( CONTROL | DATA ) Description Create a SSL policy label. Arguments labelName The name of the SSL policy label to be created. type Specifies when policies bound to this policy label will be evaluated. Possible values: CONTROL, DATA
Example add ssl policylabel ssl_pol_label -type REQ
Related Commands rm ssl policylabel bind ssl policylabel unbind ssl policylabel show ssl policylabel
rm ssl policylabel
Synopsis rm ssl policylabel <labelName> Description Remove a SSL policy label. Arguments labelName The name of the SSL policy label to be removed. Example rm ssl policylabel ssl_pol_label
Related Commands add ssl policylabel bind ssl policylabel unbind ssl policylabel show ssl policylabel
bind ssl policylabel

Synopsis bind ssl policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind an SSL policy to a SSL policy label. Arguments labelName Name of the SSL policy label. policyName The SSL policy name.
Example bind ssl policylabel ssl_pol_label -policyName ssl_pol -priority 1 Related Commands add ssl policylabel rm ssl policylabel unbind ssl policylabel show ssl policylabel
unbind ssl policylabel

Synopsis unbind ssl policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind an SSL policy from a SSL policy label. Arguments labelName Name of the SSL policy label. policyName The SSL policy name. Example unbind ssl policylabel ssl_pol_label ssl_pol Related Commands add ssl policylabel rm ssl policylabel bind ssl policylabel show ssl policylabel
show ssl policylabel

Synopsis show ssl policylabel [<labelName>] Description Display all SSL policy labels or all policies bound to a SSL policy label. Arguments labelName The name of the SSL policy label. summary fullValues format
level stateflag type Specifies when policies bound to this policy label will be evaluated. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The SSL policy name. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType Flowtype of the bound SSL policy. description Description of the policylabel flags count Example i) show ssl policylabel ssl_pol_label ii) show ssl policylabel
Related Commands add ssl policylabel rm ssl policylabel bind ssl policylabel unbind ssl policylabel
add ssl ocspResponder

Synopsis add ssl ocspResponder <name> -url <URL> [-cache ( ENABLED | DISABLED ) [-cacheTimeout <positive_integer>]] [-batchingDepth <positive_integer>] [-batchingDelay <positive_integer>] [-resptimeout <positive_integer>] [-responderCert <string> | -trustResponder] [-producedAtTimeSkew <positive_integer>] [signingCert <string>] [-useNonce ( YES | NO )] [-insertClientCert ( YES | NO )]
Description Add an OCSP responder object. Arguments name The name of the OCSP responder. url The URL of the OCSP responder. cache Enable or disable caching of OCSP responses. Possible values: ENABLED, DISABLED cacheTimeout Optional OCSP cache time out in minutes. If omitted, the timeout provided in the OCSP response will be used. Default value: 1 Minimum value: 1 Maximum value: 1440 batchingDepth Maximum number of client certificates to batch together into one OCSP request; a value of 1 makes each request separate and immediate. Minimum value: 1 Maximum value: 8 batchingDelay Maximum time, in mS, to wait to accumulate OCSP requests to batch. If batching depth is 1, this argument has no effect. Maximum value: 10000 resptimeout Maximum time, in mS, to wait for an OCSP response before giving up. Defaults to 2000 mS. Total waiting time is also dependent on batching delay as the sum of these two values will give you the total waiting time. If batching is disabled, timeout is completely governed by this parameter. Maximum value: 120000 responderCert producedAtTimeSkew Amount of time, in seconds, that the NetScaler clock and the clock of the OCSP responder can differ for checking the producedAt time in the response. Default is 300 seconds (5 minutes). Default value: 300 Maximum value: 86400 signingCert The certificate used to optionally sign OCSP requests. If omitted, requests will not be signed. useNonce Add a nonce to the OCSP request. Possible values: YES, NO insertClientCert Include the client cert in the OCSP request. Possible values: YES, NO Example 1) add ssl ocspResponder -url http://ocsp.example.com -producedAtTimeSkew 0 The above command will only allow responses that were generated in the same second to be used. That is, if the response was generated at 12:00:01, it would have to be received by the NetScaler by 12:00:59 to be considered still valid. 2) add ssl ocspResponder -url http://ocsp.example.com producedAtTimeSkew 300 This command will allow responses to vary up to five minutes plus or minus. That is, if the response has a producedAt time of 12:00:00, it will be accepted at the NetScaler if the local clock is between 11:55:00 and 12:05:00 Related Commands rm ssl ocspResponder
set ssl ocspResponder unset ssl ocspResponder show ssl ocspResponder
rm ssl ocspResponder
Synopsis rm ssl ocspResponder <name> ... Description Remove the specified OCSP responder from the system. Arguments name The name of the certificate-key pair. Note: The OCSP responder is removed only when it is not referenced by any other object. Example 1) rm ssl ocspResponder o1 The above command removes the OCSP responder o1 from the system. Related Commands add ssl ocspResponder set ssl ocspResponder unset ssl ocspResponder show ssl ocspResponder
set ssl ocspResponder

Synopsis set ssl ocspResponder <name> [-url <URL>] [-cache ( ENABLED | DISABLED )] [-cacheTimeout <positive_integer>] [-batchingDepth <positive_integer>] [-batchingDelay <positive_integer>] [-resptimeout <positive_integer>] [-responderCert <string> | -trustResponder] [-producedAtTimeSkew <positive_integer>] [signingCert <string>] [-useNonce ( YES | NO )] [-insertClientCert ( YES | NO )] Description Set an OCSP responder object's properties. Arguments name The name of the OCSP responder. url The URL of the OCSP responder. cache Enable or disable caching of OCSP responses. Possible values: ENABLED, DISABLED cacheTimeout Optional OCSP cache time out in minutes. If omitted, the timeout provided in the OCSP response will be used. Default value: 1 Minimum value: 1 Maximum value: 1440
batchingDepth Maximum number of client certificates to batch together into one OCSP request; a value of 1 makes each request separate and immediate. Minimum value: 1 Maximum value: 8 batchingDelay Maximum time, in mS, to wait to accumulate OCSP requests to batch. If batching depth is 1, this argument has no effect. Maximum value: 10000 resptimeout Maximum time, in mS, to wait for an OCSP response before giving up. Defaults to 2000 mS. If this is set to 0, NetScaler will wait for an indefinite amount of time. Maximum value: 120000 responderCert producedAtTimeSkew Amount of time, in seconds, that the NetScaler clock and the clock of the OCSP responder can differ for checking the producedAt time in the response. Default is 300 seconds (5 minutes). Default value: 300 Maximum value: 86400 signingCert The certificate used to optionally sign OCSP requests. If omitted, requests will not be signed. useNonce Add a nonce to the OCSP request. Protects against replay attacks. Possible values: YES, NO insertClientCert Include the client cert in the OCSP request. Possible values: YES, NO Example 1) add ssl ocspResponder -url http://ocsp.example.com -producedAtTimeSkew 0 The above command will only allow responses that were generated in the same second to be used. That is, if the response was generated at 12:00:01, it would have to be received by the NetScaler by 12:00:59 to be considered still valid. 2) add ssl ocspResponder -url http://ocsp.example.com producedAtTimeSkew 300 This command will allow responses to vary up to five minutes plus or minus. That is, if the response has a producedAt time of 12:00:00, it will be accepted at the NetScaler if the local clock is between 11:55:00 and 12:05:00
Related Commands add ssl ocspResponder rm ssl ocspResponder unset ssl ocspResponder show ssl ocspResponder
unset ssl ocspResponder

Synopsis unset ssl ocspResponder <name> [-trustResponder] [-insertClientCert ( YES | NO )] [-url] [-cache] [-cacheTimeout] [-batchingDepth] [-batchingDelay] [-resptimeout] [-responderCert] [-producedAtTimeSkew] [-signingCert] [useNonce] Description Unset an OCSP responder object's properties..Refer to the set ssl ocspResponder command for meanings of the arguments.
Arguments Example
Related Commands add ssl ocspResponder rm ssl ocspResponder set ssl ocspResponder show ssl ocspResponder
show ssl ocspResponder

Synopsis show ssl ocspResponder [<name>] Description Add an OCSP responder object. Arguments name The name of the OCSP responder. summary fullValues format level url The URL of the OCSP responder. useAIA Only use the URL present in the certificate. cache Enable or disable caching of OCSP responses. cacheTimeout Optional OCSP cache time out in minutes. If omitted, the timeout provided in the OCSP response will be used. batchingDepth Maximum number of client certificates to batch together into one OCSP request; a value of 1 makes each request separate and immediate. batchingDelay Maximum time, in mS, to wait to accumulate OCSP requests to batch. If batching depth is 1, this argument has no effect. resptimeout Maximum time, in mS, to wait for an OCSP response before giving up. Defaults to 2000 mS. If this is set to 0, NetScaler will wait for an indefinite amount of time. producedAtTimeSkew
Amount of time, in seconds, that the NetScaler clock and the clock of the OCSP responder can differ for checking the producedAt time in the response. Default is 300 seconds (5 minutes). responderCert trustResponder A certificate to use to validate OCSP responses. Alternatively, if -trustResponder is specified, no verification will be done on the reponse. If both are omitted, only the response times (producedAt, lastUpdate, nextUpdate) will be verified. signingCert The certificate used to optionally sign OCSP requests. If omitted, requests will not be signed. useNonce Add a nonce to the OCSP request. Protects against replay attacks. dns Was DNS resolution successful for a domain-based OCSP responder insertClientCert Include the client cert in the OCSP request. IPAddress The IPv6 address of the ocsp responder. count stateflag Example
Related Commands add ssl ocspResponder rm ssl ocspResponder set ssl ocspResponder unset ssl ocspResponder
create ssl rsakey

Synopsis create ssl rsakey <keyFile> <bits> [-exponent ( 3 | F4 )] [-keyform ( DER | PEM )] [-des | -des3] {-password } Description Generate an RSA key. Arguments keyFile The file in which the generated RSA key is stored. The default output path for the key file is / nsconfig/ssl/. Maximum value: 63 bits The bit value (key length) for the RSA key. Minimum value: 512 Maximum value: 4096 exponent The public exponent value for the RSA key. The supported values are F4 (Hex: 0x10001) or 3 (Hex: 0x3). Possible values: 3, F4 Default value: FIPSEXP_F4
keyform The format for the key file: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM des Encrypt the generated RSA key using DES algorithm. You will be prompted to enter the passphrase (password) that will be used to encrypt the key. des3 Encrypt the generated RSA key using the Triple-DES algorithm. You will be prompted to enter the pass-phrase (password) that will be used to encrypt the key. password The pass-phrase to use for encryption if '-des' or '-des3' option is selected. Maximum value: 31 Example create ssl rsakey /nsconfig/ssl/rsa1024.pem 1024 -exp F4 Related Commands create ssl cert create ssl certreq add ssl certkey
convert ssl pkcs12

Synopsis convert ssl pkcs12 <outfile> [-import [-pkcs12File <input_filename>] [-des | -des3] ] [-export [-certFile <input_filename>] [-keyFile <input_filename>]] {-password } {-PEMPassPhrase } Description Convert the end-user certificate (Client-certificate/Server-Certificate) from PEM encoding format to PKCS#12 format. These certificates can then be distributed and installed in browsers as Client certificates. Arguments outfile The output file to be generated. If the -import option is used, this file will be used to store the certificate and the private-key in PEM format. If the -export option is used, the certificate and private-key will be stored in the PKCS12 format. The default output path for the file is /nsconfig/ ssl/. Maximum value: 63 import Convert the certificate and private-key from PKCS12 format to PEM format. export Convert the certificate and private-key from PEM format to PKCS12 format. Note: During the export operation, you will be prompted to enter the 'Export password' password PEMPassPhrase Example 1) convert ssl pkcs12 /nsconfig/ssl/client_certkey.p12 -export -cert /nsconfig/ssl/ client_certcert.pem -key /nsconfig/ssl/client_key.pem The above example CLI command
converts the PEM encoded certificate and key file to PKCS#12. 2) convert ssl pkcs12 /nsconfig/ ssl/client_certkey.pem -import -pkcs12 /nsconfig/ssl/client_certcertkey.p12 The above example CLI command converts the PKCS12 file to PEM format. 3) convert ssl pkcs12 /nsconfig/ssl/ client_certkey.pem -import -pkcs12 /nsconfig/ssl/client_certcertkey.p12 -des The above example CLI command converts the PKCS12 file to PEM format, with encrypted key. Note: The -des option will encrypt the output key using DES algorithm. User will be prompted to enter the passphrase to be used for encryption. Related Commands create ssl rsakey create ssl dsakey create ssl certreq create ssl cert
convert ssl pkcs8

Synopsis convert ssl pkcs8 <pkcs8File> <keyFile> [-keyform ( DER | PEM )] {-password } Description Convert a PEM or DER encoded key file to PKCS#8 format before importing it into the System's FIPS system. Arguments pkcs8File The name of the output file where the PKCS8 format key file will be stored. The default output path for the PKCS8 file is /nsconfig/ssl/. Maximum value: 63 keyFile The input key file. The default input path for the key file is /nsconfig/ssl/. Maximum value: 63 keyform The format of the keyFile. PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM password The password if the key is encrypted. Valid for PEM encoded files only. Maximum value: 31 Example convert ssl pkcs8 /nsconfig/ssl/key.pk8 /nsconfig/ssl/key.pem Related Commands
create ssl dhParam

Synopsis create ssl dhParam <dhFile> [<bits>] [-gen ( 2 | 5 )] Description Generate the Diffie-Hellman (DH) parameters. Arguments dhFile The name of the output file where the generated DH parameter is stored. Maximum value: 63
bits The bit value for the DH parameters.Maximum bit value allowed is 2048. Minimum value: 512 Maximum value: 2048 gen The DH generator value (g) to be used. Possible values: 2, 5 Default value: 2 Example 1) create ssl dhparam /nsconfig/ssl/dh1024.pem 1024 -gen 5 Related Commands set ssl vserver show ssl vserver
create ssl dsaKey

Synopsis create ssl dsaKey <keyFile> <bits> [-keyform ( DER | PEM )] [-des | -des3] {-password } Description Generate a DSA key. Arguments keyFile The name of the output file where the generated DSA key is stored. The default output path for the DH file is /nsconfig/ssl/. Maximum value: 63 bits The bit value (key length) for the DSA key. Minimum value: 512 Maximum value: 2048 keyform The format of the key file: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule. Possible values: DER, PEM Default value: FORMAT_PEM des Encrypt the generated DSA key using the DES algorithm. It prompts you to enter the pass-phrase (password) that is used to encrypt the key. des3 Encrypt the generated DSA key using Triple-DES algorithm. You will be prompted to enter the pass-phrase (password) that is used to encrypt the key. password The pass-phrase to use for encryption if '-des' or '-des3' option is selected. Maximum value: 31 Example create ssl dsakey /nsconfig/ssl/dsa1024.pem 1024 Related Commands create ssl cert create ssl certreq add ssl certkey
show ssl certLink

Synopsis show ssl certLink Description Display all the linked certificate-key pairs in the system. Arguments summary fullValues format level certkeyName Certificate key name. linkCertKeyName Name of the Certificate-Authority. count stateflag Example The following shows an example of the output of the show ssl certlink command: linked certificate: 1) Cert Name: siteAcertkey CA Cert Name: CAcertkey Related Commands link ssl certkey unlink ssl certkey
create ssl certReq

Synopsis create ssl certReq <reqFile> (-keyFile <input_filename> | -fipsKeyName <string>) [-keyform ( DER | PEM ) {-PEMPassPhrase }] -countryName <string> -stateName <string> -organizationName <string> [organizationUnitName <string>] [-localityName <string>] [-commonName <string>] [-emailAddress <string>] {challengePassword } [-companyName <string>] Description Generate a new Certificate Signing Request (CSR). The generated CSR can be sent to a Certificate-Authority (CA) to obtain an X509 certificate for the user domain (web site). Arguments reqFile The file name where the generated Certificate Signing Requests are stored. The default output path for the CSR file is /nsconfig/ssl/. Maximum value: 63 keyFile The key file name to be used. The key can be an RSA or a DSA key. The default input path for the key file is /nsconfig/ssl/. Maximum value: 63
fipsKeyName The FIPS key name to be used. FIPS keys are created inside the FIPS HSM (Hardware Security Module). This is applicable only to the SSL FIPS system. keyform The format for the input key file specified in the keyFileName: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM countryName Country Name - Two letter ISO code for your country. For example, US for United States. stateName State or Province Name - Full name for the state or province where your organization is located. Maximum characters allowed are 63. Do not abbreviate. organizationName Organization Name - Name of the organization. The organization name (corporation, limited partnership, university, or government agency) must be registered with some authority at the national, state, or city level. Use the legal name under which the organization is registered. Maximum characters allowed are 63. Do not abbreviate the organization name and do not use the following characters in the name: < > ~ ! @ # 0 ^ * / ( )?. organizationUnitName Organization Unit Name - Division or Section name in the organization that will use the certificate. Maximum characters allowed are 63. localityName Locality Name - Name of the city or town in which your organization's head office is located.Maximum characters allowed are 127. commonName Common Name - Fully qualified domain name for the company/Web site. The common name is the fully qualified domain name (FQDN) for the company/Web site. The common name must match the name used by DNS servers to do a DNS lookup of your server (for example, www.mywebsite.com <http://www.mywebsite.com>). Most browsers use this information for authenticating the server's certificate during the SSL handshake. If the server name does not match the common name as given in the server certificate, the browsers will terminate the SSL handshake or prompt the user with a warning message. The maximum characters allowed are 63. CAUTION: Do not use wildcard characters such as * or ? and do not use an IP address as the common name. The common name should be without the protocol specifier <http://> or <https://>. emailAddress Challenge Password - The contact person's E-mail address. challengePassword Challenge Password - Challenge password for this certificate. companyName Optional Company Name - Additional name of the company/web-site. Example create ssl certreq /nsconfig/ssl/csr.pem -keyFile /nsconfig/ssl/rsa1024.pem Related Commands create ssl cert create ssl rsakey create ssl dsakey
create ssl cert

Synopsis create ssl cert <certFile> <reqFile> <certType> [-keyFile <input_filename>] [-keyform ( DER | PEM ) {PEMPassPhrase }] [-days <positive_integer>] [-certForm ( DER | PEM )] [-CAcert <input_filename>] [-CAcertForm ( DER | PEM )] [-CAkey <input_filename>] [-CAkeyForm ( DER | PEM )] [-CAserial <output_filename>] Description Generate a signed X509 Certificate. Arguments certFile The name of the generated certificate file. The default path of the certificate file is /nsconfig/ssl/. Maximum value: 63 reqFile The Certificate Signing Request (CSR) file that is used to generate the certificate. This file is created using the "create ssl certreq" command or an existing CSR. The default input path for the CSR file is /nsconfig/ssl/. Maximum value: 63 certType The type of the certificate to be generated. ROOT_CERT : The certificate generated will be a selfsigned Root-CA certificate. For this, you need to specify the -keyfile parameter. The generated Root-CA certificate can be used for signing end-user certificates (Client/Server) or to create Intermediate-CA certificates. INTM_CERT : The certificate generated will be an IntermediateCA certificate. For this, you need to specify the following parameters: -CAcert , -CAkey, and CAserial. NOTE: The three parameters are also mandatory for the CLNT_CERT or SRVR_CERT certificate types. CLNT_CERT : The certificate generated will be an end-user client certificate. This can be used in a Client-Authentication setup. SRVR_CERT : The certificate generated will be an end-user Server certificate. This can be used as an SSL server certificate on the backend SSL servers for an SSL backend-encryption setup with the system. NOTE: Avoid using the Server certificate (generated above) for a front-end SSL virtual server (or SSL service) on a system or on any frontend SSL server if the certificate is signed by System. The same is true with System generated Intermediate-CA or Root-CA certificate. The reason being, the System generated CA certificates will not be present in browsers (such as IE, Netscape, and other browsers) by default. So during the SSL handshake the Server Certificate verification will fail. Browsers generally display a warning message and prompt the user to either continue with the SSL handshake or terminate it. If the System generated CA certificates are installed in the browsers as trusted CA certificates, the SSL handshake will proceed without any errors or warnings. Possible values: ROOT_CERT, INTM_CERT, CLNT_CERT, SRVR_CERT keyFile The input keyFile to sign the certificate being generated. This keyFile is created using the "create ssl rsakey" or "create ssl dsakey" commands, or an existing RSA/DSA key. This file is required only when creating a self-signed Root-CA certificate. The default input path for the keyFile is /nsconfig/ ssl/. Note: If the input key specified is an encrypted key, the user will be prompted to enter the PEM pass-phrase that was used for encrypting the key. Maximum value: 63 keyform The format for the input key file: PEM : Privacy Enhanced Mail DER : Distinguished Encoding Rule. Possible values: DER, PEM Default value: FORMAT_PEM PEMPassPhrase days The number of days for which the certificate will be valid. The certificate is valid from the time and day (system time) of the creation, to the number of days specified in the -days field.The maximum value allowed is 3650 Default value: 365 Minimum value: 1 Maximum value: 3650
certForm The output certificate format: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM CAcert The CA certificate file that will issue and sign the Intermediate-CA certificate or the end-user certificates (Client/Server). The default input path for the CA certificate file is /nsconfig/ssl/. Maximum value: 63 CAcertForm The format of the input CA certificate file: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM CAkey The CA key file that will be used to sign the Intermediate-CA certificate or the end-user certificates (Client/Server). The default input path for the CA key file is /nsconfig/ssl/. Note: If the CA key file is password protected, the user will be prompted to enter the pass-phrase used for encrypting the key. Maximum value: 63 CAkeyForm The format of the input CA key file: PEM: Privacy Enhanced Mail DER: Distinguished Encoding Rule Possible values: DER, PEM Default value: FORMAT_PEM CAserial The Serial number file maintained for the CA certificate. This will contain the serial number of the next certificate to be issued/signed by the CA (-CAcert). If the specified file does not exist, a new file will be created. The default input path for the CAserial file name is /nsconfig/ssl/. Note: Specify the proper path of the existing serial file; else a new serial file will be created. This may change the certificate serial numbers assigned by the CA certificate to each of the certificate it signs. Maximum value: 63 Example 1) create ssl cert /nsconfig/ssl/root_cert.pem /nsconfig/ssl/root_csr.pem ROOT_CERT keyFile /nsconfig/ssl/root_key.pem -days 1000 The above example creates a self signed RootCA certificate. 2) create ssl cert /nsconfig/ssl/server_cert.pem /nsconfig/ssl/server_csr.pem SRVR_CERT -CAcert /nsconfig/ssl/root_cert.pem -CAkey /nsconfig/ssl/root_key.pem CAserial /nsconfig/ssl/root.srl The above example creates a Server certificate which is signed by the Root-CA certificate: root_cert.pem
Related Commands create ssl certreq create ssl rsakey create ssl dsakey add ssl certkey
show ssl stats

Synopsis show ssl stats - alias for 'stat ssl' Description show ssl stats is an alias for stat ssl
Arguments Example
Related Commands stat ssl
set ssl parameter

Synopsis set ssl parameter [-quantumSize <quantumSize>] [-crlMemorySizeMB <positive_integer>] [-strictCAChecks ( YES | NO )] [-sslTriggerTimeout <positive_integer>] [-sendCloseNotify ( YES | NO )] [-encryptTriggerPktCount <positive_integer>] [-denySSLReneg <denySSLReneg>] [-insertionEncoding ( Unicode | UTF-8 )] [ocspCacheSize <positive_integer>] [-pushFlag <positive_integer>] [-dropReqWithNoHostHeader ( YES | NO )] [pushEncTriggerTimeout <positive_integer>] [-undefActionControl <string>] [-undefActionData <string>] Description
Arguments quantumSize SSL quantum size configures the amount of data to be collected before we push the data to the crypto hardware for encryption. Setting the right quantum size based on the application requirements will help to better utilize the crypto resources. For example, in case of large downloads, larger quantum size is beneficial. Possible values: 4096, 8192, 16384 Default value: 8192 crlMemorySizeMB Memory size to use for CRLs. Set the maximum system memory size, the CRL(s) can consume. This setting will not reserve the memory for CRL, but will set the max limit all CRL(s) loaded in the system can consume. Default value: 256 Minimum value: 10 Maximum value: 1024 strictCAChecks Enable strict CA certificate checks. Possible values: YES, NO Default value: NO sslTriggerTimeout Encryption trigger timer. Set the encryption trigger timeout for transactions, which are not trackable by Netscaler. NetScaler will use this setting to accumulate data received from the server for the configured time period before pushing it to the crypto hardware for encryption Default value: 100 Minimum value: 1 Maximum value: 200 sendCloseNotify Enable sending SSL Close-Notify at the end of a transaction Possible values: YES, NO Default value: YES encryptTriggerPktCount Number of queued packets that force encryption to occur. Set the maximum number of packets to accumulate before triggering encryption to the crypto hardware. Default setting is 45 packets. This setting can be used for non-trackable transactions which generates small size packets from server to NetScaler. Default value: 45 Minimum value: 10 Maximum value: 50 denySSLReneg SSL Renegotiation setting NO: Allow SSL renegotiation to work. FRONTEND_CLIENT: Deny SSL renegotiation initiated by the client. FRONTEND_CLIENTSERVER: Deny SSL renegotiation initiated by the client and by NS (during policy-based clientAuth). NONSECURE.
Deny nonsecure SSL renegotiation. This option will only allow clients which support RFC 5746. ALL: Deny SSL renegotiation for above two cases and for server initiated renegotiation on the backend side. Possible values: NO, FRONTEND_CLIENT, FRONTEND_CLIENTSERVER, ALL, NONSECURE Default value: NO insertionEncoding Encoding method used to insert Subject/Issuer in HTTP Request to backend servers. Possible values: Unicode, UTF-8 Default value: UNICODE_INSERTION ocspCacheSize Size, per packet engine, in megabytes of the OCSP cache. The actual maximum value for this value is clamped at 10% of packet engine memory. Maximum packet engine memory is 4GB; thus, if you have enough memory to give all packet engines 4GB of memory, the maximum value here would be approximately 410 MB. Default value: 10 Maximum value: 512 pushFlag PUSH insertion cotnrol flags (Can be ORed): 0 auto, 0x1 = every decrypted record, 0x2 = every encrypted record Maximum value: 3 dropReqWithNoHostHeader Host header check for SNI enabled sessions. If this check is enabled and if the HTTP request does not contain the Host header for SNI enabled session, then the request will be dropped Possible values: YES, NO Default value: NO pushEncTriggerTimeout PUSH encryption trigger timer Default value: 1 Minimum value: 1 Maximum value: 200 undefActionControl Name of undef action. It can be SSL control builtin action like CLIENTAUTH, NOCLIENTAUTH or an action like NOOP, RESET, DROP. Default value: "CLIENTAUTH" undefActionData Name of undef action. It can be NOOP, RESET or DROP Default value: "NOOP" Example
Related Commands unset ssl parameter show ssl parameter
unset ssl parameter

Synopsis unset ssl parameter [-quantumSize] [-crlMemorySizeMB] [-strictCAChecks] [-sslTriggerTimeout] [sendCloseNotify] [-encryptTriggerPktCount] [-denySSLReneg] [-insertionEncoding] [-ocspCacheSize] [-pushFlag] [dropReqWithNoHostHeader] [-pushEncTriggerTimeout] [-undefActionControl] [-undefActionData] Description Use this command to remove ssl parameter settings.Refer to the set ssl parameter command for meanings of the arguments. Arguments Example
Related Commands set ssl parameter show ssl parameter
show ssl parameter

Synopsis show ssl parameter Description Display ssl advanced parameters. Arguments format level quantumSize SSL quantum size configures the amount of data to be collected before we push the data to the crypto hardware for encryption. Setting the right quantum size based on the application requirements will help to better utilize the crypto resources. For example, in case of large downloads, larger quantum size is beneficial. crlMemorySizeMB Memory size to use for CRLs. Set the maximum system memory size, the CRL(s) can consume. This setting will not reserve the memory for CRL, but will set the max limit all CRL(s) loaded in the system can consume. strictCAChecks Memory size to use for CRLs sslTriggerTimeout Encryption trigger timer. Set the encryption trigger timeout for transactions, which are not trackable by Netscaler. NetScaler will use this setting to accumulate data received from the server for the configured time period before pushing it to the crypto hardware for encryption. sendCloseNotify Enable sending SSL Close-Notify at the end of a transaction encryptTriggerPktCount Number of queued packets that force encryption to occur. Set the maximum number of packets to accumulate before triggering encryption to the crypto hardware. Default setting is 45 packets. This setting can be used for non-trackable transactions which generates small size packets from server to NetScaler. denySSLReneg SSL Renegotiation setting insertionEncoding Encoding method used to insert Subject/Issuer in HTTP Request to backend servers. ocspCacheSize Size, per packet engine, in megabytes of the OCSP cache pushFlag PUSH insertion cotnrol flags (Can be ORed): 0 auto, 0x1 = every decrypted record, 0x2 = every encrypted record
dropReqWithNoHostHeader Host header check for SNI enabled sessions. If this check is enabled and if the HTTP request does not contain the Host header for SNI enabled session, then the request will be dropped pushEncTriggerTimeout PUSH encryption trigger timer undefActionControl Global undef action for SSL control policies undefActionData Global undef action for SSL data policies Example
Related Commands set ssl parameter unset ssl parameter
set ssl fips

Synopsis set ssl fips -initHSM Level-2 [-hsmLabel <string>] Description Initialize the Hardware Security Module (HSM) or the FIPS card and set a new Security Officer password and User password. CAUTION: This command will erase all data on the FIPS card. You will be prompted before proceeding with the command execution. Save the current configuration after executing this command. Arguments initHSM The FIPS initialization level. Possible values: Level-2 soPassword The Hardware Security Module's (HSM) Security Officer password. oldSoPassword The old Security Officer password. This is used for authentication. userPassword The Hardware Security Module's (HSM) User password. hsmLabel The label to identify the Hardware Security Module (HSM). Example 1) set fips -initHSM Level-2 fipsso123 oldfipsso123 fipuser123 -hsmLabel FIPS-140-2 >This command will erase all data on the FIPS card. You must save the configuration (saveconfig) after executing this command.Do you want to continue?(Y/N)y The above command initializes the FIPS card to FIPS-140-2 Level-2 and sets the HSM's Security Officer and User passwords. Related Commands unset ssl fips
reset ssl fips show ssl fips update ssl fips
unset ssl fips

Synopsis unset ssl fips -hsmLabel Description Use this command to remove ssl fips settings.Refer to the set ssl fips command for meanings of the arguments. Arguments Example
Related Commands set ssl fips reset ssl fips show ssl fips update ssl fips
reset ssl fips

Synopsis reset ssl fips Description Reset the FIPS card to default password for SO and User accounts. Note: This command can be used only if the FIPS card has been locked due to three or more unsuccessful login attempts Arguments Example reset fips Related Commands set ssl fips unset ssl fips show ssl fips update ssl fips
show ssl fips

Synopsis show ssl fips
Description Display the information on the FIPS card. Arguments format level initHSM The level of the FIPS initialization. soPassword The Hardware Security Module's (HSM) Security Officer password. userPassword The Hardware Security Module's (HSM) User password. oldSoPassword The old Security Officer password. This is used for authentication. eraseData Erase data. hsmLabel FIPS card (HSM) label serial FIPS card serial number. majorVersion Firmware major version. minorVersion Firmware minor version. flashMemoryTotal Total size of the flash memory on card. flashMemoryFree Total size of free flash memory. sramTotal Total size of the SRAM memory on card. sramFree Total size of free SRAM memory. status Status. flag Internal Flags. serialNo FIPS card serial number. state FIPS card state. firmwareReleaseDate FIPS card firmware revision date. coresMax
Maximum number of crypto cores present in the FIPS card. coresEnabled Number of crypto cores enabled in the FIPS card. Example An example of the output for show ssl fips command is as follows: FIPS HSM Info: HSM Label : FIPS1 Initialization : FIPS-140-2 Level-2 HSM Serial Number : 238180016 Firmware Version : 4.3.0 Total Flash Memory : 1900428 Free Flash Memory : 1899720 Total SRAM Memory : 26210216 Free SRAM Memory : 17857232
Related Commands set ssl fips unset ssl fips reset ssl fips update ssl fips
update ssl fips

Synopsis update ssl fips -fipsFW 4.6.1 Description Update the FIPS firmware. Note: Only compatible firmware version upgrade is allowed, e.g 4.6.0 to 4.6.1 Arguments fipsFW The FIPS firmware update. Possible values: 4.6.1 Example update ssl fips -fipsFW 4.6.1
Related Commands set ssl fips unset ssl fips reset ssl fips show ssl fips
set ssl service

Synopsis set ssl service <serviceName>@ [-dh ( ENABLED | DISABLED ) -dhFile <string>] [-dhCount <positive_integer>] [-eRSA ( ENABLED | DISABLED ) [-eRSACount <positive_integer>]] [-sessReuse ( ENABLED | DISABLED ) [-sessTimeout <positive_integer>]] [-cipherRedirect ( ENABLED | DISABLED ) [-cipherURL <URL>]] [sslv2Redirect ( ENABLED | DISABLED ) [-sslv2URL <URL>]] [-clientAuth ( ENABLED | DISABLED ) [clientCert ( Mandatory | Optional )]] [-sslRedirect ( ENABLED | DISABLED )] [-redirectPortRewrite ( ENABLED | DISABLED )] [-nonFipsCiphers ( ENABLED | DISABLED )] [-ssl2 ( ENABLED | DISABLED )] [-ssl3
( ENABLED | DISABLED )] [-tls1 ( ENABLED | DISABLED )] [-SNIEnable ( ENABLED | DISABLED )] [serverAuth ( ENABLED | DISABLED )] [-pushEncTrigger <pushEncTrigger>] Description Set the Advance SSL Configurations for an SSL service. Arguments serviceName The SSL service name for which the advance configurations are to be set. dh The state of Diffie-Hellman (DH) key exchange support for the SSL service. Possible values: ENABLED, DISABLED Default value: DISABLED dhCount The refresh count for regeneration of DH public-key and private-key from the DH parameter. Zero means infinite usage (no refresh). Option '-dh' has to be enabled Maximum value: 65534 eRSA The state of Ephemeral RSA key exchange support for the SSL service. Ephemeral RSA is used for export ciphers. Possible values: ENABLED, DISABLED Default value: ENABLED sessReuse The state of session reuse support for the SSL service. Possible values: ENABLED, DISABLED Default value: ENABLED cipherRedirect The state of Cipher Redirect feature. Cipher Redirect feature can be used to provide more readable information to SSL clients about mismatch in ciphers between the client and the SSL vserver. Possible values: ENABLED, DISABLED Default value: DISABLED sslv2Redirect The state of SSLv2 Redirect feature . SSLv2 Redirect feature can be used to provide more readable information to SSL client about non-support of SSLv2 protocol on the SSL vserver. Possible values: ENABLED, DISABLED Default value: DISABLED clientAuth The state of Client-Authentication support for the SSL service. Possible values: ENABLED, DISABLED Default value: DISABLED sslRedirect The state of HTTPS redirects for the SSL service. This is required for the proper functioning of the redirect messages from the server. The redirect message from the server provides the new location for the moved object. This is contained in the HTTP header field: Location, e.g. Location: http:// www.moved.org/here.html For the SSL session, if the client browser receives this message, the browser will try to connect to the new location. This will break the secure SSL session, as the object has moved from a secure site (https://) to an un-secure one (http://). Generally browsers flash a warning message on the screen and prompt the user, either to continue or disconnect. The above feature, when enabled will automatically convert all such http:// redirect message to https://. This will not break the client SSL session. Note: The set ssl service command can be used for configuring a front-end SSL service for service based SSL Off-Loading, or a backend SSL service for backend-encryption setup. Some of the command options are not applicable while configuring a backend service. System will not report an error if these options are used for a backend SSL service. These are: [-dh (ENABLED|DISABLED) (-dhFile < file_name >)] [(-dhCount <pos_int>)] [-eRSA (ENABLED|DISABLED)] [(-eRSACount <pos_int>)] [-cipherRedirect (ENABLED | DISABLED) [-cipherURL <URL>]] [-sslv2Redirect ( ENABLED | DISABLED ) [-sslv2URL <URL>]] [clientAuth ( ENABLED | DISABLED ) [-clientCert ( Mandatory | Optional )]] [-sslRedirect ( ENABLED | DISABLED )] [-ssl2 (ENABLED|DISABLED)]. Possible values: ENABLED, DISABLED Default value: DISABLED
redirectPortRewrite The state of the port in rewrite while performing HTTPS redirect. Possible values: ENABLED, DISABLED Default value: DISABLED nonFipsCiphers The state of usage of non FIPS approved ciphers. Valid only for an SSL service bound with a FIPS key and certificate. Possible values: ENABLED, DISABLED Default value: DISABLED ssl2 The state of SSLv2 protocol support for the SSL service. Possible values: ENABLED, DISABLED Default value: DISABLED ssl3 The state of SSLv3 protocol support for the SSL service. Possible values: ENABLED, DISABLED Default value: ENABLED tls1 The state of TLSv1 protocol support for the SSL service. Possible values: ENABLED, DISABLED Default value: ENABLED SNIEnable The state of SNI Extension. Server Name Indication (SNI) helps to enable SSL encryption on multiple subdomains if the domains are controlled by the same organization and share the same second-level domain name. State of SNI feature on service Possible values: ENABLED, DISABLED Default value: DISABLED serverAuth The state of Server-Authentication support for the SSL service. Possible values: ENABLED, DISABLED Default value: DISABLED pushEncTrigger PUSH packet triggering encryption Always - Any PUSH packet triggers encryption Ignore - Ignore PUSH packet for triggering encryption Merge - For consecutive sequence of PUSH packets, last PUSH packet triggers encryption Timer - PUSH packet triggering encryption delayed by timer period defined in 'set ssl parameter' Possible values: Always, Merge, Ignore, Timer Example 1) set ssl service sslsvc -dh ENABLED -dhFile /nsconfig/ssl/dh1024.pem -dhCount 500 The above example sets the DH parameters for the SSL service 'sslsvc'. 2. set ssl service sslsvc -ssl2 DISABLED The above example disables the support for SSLv2 protocol for the SSL service 'sslsvc'. Related Commands unset ssl service bind ssl service unbind ssl service show ssl service
unset ssl service

Synopsis unset ssl service <serviceName>@ [-dh] [-dhFile] [-dhCount] [-eRSA] [-eRSACount] [-sessReuse] [-sessTimeout] [-cipherRedirect] [-cipherURL] [-sslv2Redirect] [-sslv2URL] [-clientAuth] [-clientCert] [-sslRedirect] [redirectPortRewrite] [-nonFipsCiphers] [-ssl2] [-ssl3] [-tls1] [-SNIEnable] [-serverAuth]
Description Use this command to remove ssl service settings.Refer to the set ssl service command for meanings of the arguments. Arguments Example Related Commands set ssl service bind ssl service unbind ssl service show ssl service
bind ssl service

Synopsis bind ssl service <serviceName>@ ((-policyName <string> [-priority <positive_integer>] [-gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] ) | (-certkeyName <string> [(-CA [-crlCheck ( Mandatory | Optional ) | -ocspCheck ( Mandatory | Optional )]) | -SNICert] )) Description Bind a SSL certkey or a SSL policy to a SSL service. Arguments serviceName The name of the SSL service to which the SSL policy needs to be bound. policyName The name of the SSL policy. certkeyName The name of the CertKey Example bind ssl service ssl_svc -policyName certInsert_pol -priority 10 Related Commands set ssl service unset ssl service unbind ssl service show ssl service
unbind ssl service

Synopsis unbind ssl service <serviceName>@ ((-policyName <string> [-priority <positive_integer>]) | (-certkeyName <string> [(-CA [-crlCheck ( Mandatory | Optional )]) | -SNICert] )) Description Unbind a SSL policy from a SSL service.
Arguments serviceName The name of the SSL service from which the SSL policy needs to be unbound. policyName The name of the SSL policy. certkeyName The certificate key pair binding. Example unbind ssl service ssl_svc -policyName certInsert_pol Related Commands set ssl service unset ssl service bind ssl service show ssl service
show ssl service

Synopsis show ssl service [<serviceName>] [-cipherDetails] Description View the advanced SSL settings for an SSL service. Arguments serviceName The name of the SSL service. cipherDetails Details of the individual ciphers bound to the SSL service. Select this flag value to display the details of the individual ciphers bound to the SSL service. summary fullValues format level crlCheck The state of the CRL check parameter. (Mandatory/Optional) dh The state of Diffie-Hellman (DH) key exchange support. dhFile The file name and path for the DH parameter. dhCount The refresh count for regeneration of DH public-key and private-key from the DH parameter. eRSA The state of Ephemeral RSA key exchange support. Ephemeral RSA is used for export ciphers
eRSACount The refresh count for re-generation of RSA public-key and pri-vate-key pair. sessReuse The state of session reuse support. sessTimeout The session timeout value in seconds. cipherRedirect The state of Cipher Redirect feature.Cipher Redirect feature can be used to provide more readable information to SSL clients about mismatch in ciphers between the client and the SSL vserver. cipherURL The redirect URL to be used with the Cipher Redirect feature. sslv2Redirect The state of SSLv2 Redirect feature.SSLv2 Redirect feature can be used to provide more readable information to SSL client about non-support of SSLv2 protocol on the SSL vserver. sslv2URL The redirect URL to be used with the SSLv2 Redirect feature. clientAuth The state of Client-Authentication support. clientCert The rule for client certificate requirement in client authentication. sslRedirect The state of HTTPS redirect feature. redirectPortRewrite The state of port rewrite feature. nonFipsCiphers The state of usage of non FIPS approved ciphers. ssl2 The state of SSLv2 protocol support. ssl3 The state of SSLv3 protocol support. tls1 The state of TLSv1 protocol support. SNIEnable The state of SNI extension. Server Name Indication (SNI) helps to enable SSL encryption on multiple subdomains if the domains are controlled by the same organization and share the same second-level domain name. serverAuth The state of Server-Authentication support. cipherAliasName/cipherName/cipherGroupName The cipher group/alias/individual cipher configuration. description The cipher suite description. certkeyName
The certificate key pair binding. policyName The SSL policy binding. clearTextPort The clearTextPort settings. priority The priority of the policies bound to this SSL service polinherit Whether the bound policy is a inherited policy or not ocspCheck The state of the OCSP check parameter. (Mandatory/Optional) pushEncTrigger PUSH packet triggering encryption: Always, Ignore, Merge gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. stateflag count Example An example of output of show ssl service command is as shown below show ssl service svc1 Advanced SSL configuration for Back-end SSL Service svc1: DH: DISABLED Ephemeral RSA: ENABLED Refresh Count: 0 Session Reuse: ENABLED Timeout: 300 seconds Cipher Redirect: DISABLED SSLv2 Redirect: DISABLED Server Auth: DISABLED SSL Redirect: DISABLED Non FIPS Ciphers: DISABLED SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED 1) Cipher Name: ALL Description: Predefined Cipher Alias Related Commands set ssl service unset ssl service bind ssl service unbind ssl service
set ssl serviceGroup

Synopsis set ssl serviceGroup <serviceGroupName>@ [-sessReuse ( ENABLED | DISABLED ) [-sessTimeout <positive_integer>]] [-nonFipsCiphers ( ENABLED | DISABLED )] [-ssl3 ( ENABLED | DISABLED )] [-tls1 ( ENABLED | DISABLED )] [-serverAuth ( ENABLED | DISABLED )] Description Set the Advance SSL Configurations for a SSL service group. Arguments serviceGroupName The SSL service group name for which the advance configurations are to be set.
sessReuse The state of session reuse support for the SSL service group. Possible values: ENABLED, DISABLED Default value: ENABLED nonFipsCiphers The state of usage of non FIPS approved ciphers. Valid only for an SSL service group bound with a FIPS key and certificate. Possible values: ENABLED, DISABLED Default value: DISABLED ssl3 The state of SSLv3 protocol support for the SSL service group. Possible values: ENABLED, DISABLED Default value: ENABLED tls1 The state of TLSv1 protocol support for the SSL service group. Possible values: ENABLED, DISABLED Default value: ENABLED serverAuth The state of Server-Authentication support for the SSL service group. Possible values: ENABLED, DISABLED Default value: DISABLED Example 1) set ssl servicegroup svcg1 -sessReuse DISABLED The above example disables session reuse for the service group 'svcg1'. Related Commands unset ssl serviceGroup show ssl serviceGroup
unset ssl serviceGroup

Synopsis unset ssl serviceGroup <serviceGroupName>@ [-sessReuse] [-sessTimeout] [-nonFipsCiphers] [-ssl3] [-tls1] [serverAuth] Description Use this command to remove ssl serviceGroup settings.Refer to the set ssl serviceGroup command for meanings of the arguments. Arguments Example
Related Commands set ssl serviceGroup show ssl serviceGroup
show ssl serviceGroup

Synopsis show ssl serviceGroup [<serviceGroupName>] [-cipherDetails]
Description View the advanced SSL settings for an SSL service group. Arguments serviceGroupName The name of the SSL service group. cipherDetails Display the details of the individual ciphers bound to the SSL service group. summary fullValues format level dh The state of DH key exchange support for the SSL service group. dhFile The file name and path for the DH parameter. dhCount The refresh count for the re-generation of DH public-key and private-key from the DH parameter. eRSA The state of Ephemeral RSA key exchange support for the SSL service group.Ephemeral RSA is used for export ciphers. eRSACount The refresh count for the re-generation of RSA public-key and private-key pair. sessReuse The state of session re-use support for the SSL service group. sessTimeout The Session timeout value in seconds. cipherRedirect The state of Cipher Redirect feature. Cipher Redirect feature can be used to provide more readable information to SSL clients about mismatch in ciphers between the client and the SSL vserver. cipherURL The redirect URL to be used with the Cipher Redirect feature. sslv2Redirect The state of SSLv2 Redirect feature.SSLv2 Redirect feature can be used to provide more readable information to SSL client about non-support of SSLv2 protocol on the SSL vserver. sslv2URL The redirect URL to be used with SSLv2 Redirect feature. clientAuth The state of Client-Authentication support for the SSL service group. clientCert The rule for client certificate requirement in client authentication. sslRedirect The state of HTTPS redirects for the SSL service group. This is required for the proper functioning of the redirect messages from the server. The redirect message from the server provides the new
location for the moved object. This is contained in the HTTP header field: Location, e.g. Location: http://www.moved.org/here.html For the SSL session, if the client browser receives this message, the browser will try to connect to the new location. This will break the secure SSL session, as the object has moved from a secure site (https://) to an un-secure one (http://). Generally browsers flash a warning message on the screen and prompt the user, either to continue or disconnect. The above feature, when enabled will automatically convert all such http:// redirect message to https://. This will not break the client SSL session. Note: The set ssl service command can be used for configuring a front-end SSL service for service based SSL Off-Loading, or a backend SSL service for backend-encryption setup. redirectPortRewrite The state of port-rewrite feature. nonFipsCiphers The state of usage of non FIPS approved ciphers. ssl2 The state of SSLv2 protocol support for the SSL service group. ssl3 The state of SSLv3 protocol support for the SSL service group. tls1 The state of TLSv1 protocol support for the SSL service group. serverAuth The state of the server authentication configuration for the SSL service group. For SSL deployments where data is encrypted end-to-end using SSL, you can authenticate the server. cipherAliasName/cipherName/cipherGroupName The name of the cipher group/alias/name configured for the SSL service group. description The description of the cipher. certkeyName The name of the certificate bound to the SSL service group. clearTextPort The port on the back-end web-servers where the clear-text data is sent by system. Use this setting for the wildcard IP based SSL Acceleration configuration (*:443). serviceName The service name. stateflag count Example An example of output of show ssl servicegroup command is as shown below show ssl servicegroup ssl_svcg Advanced SSL configuration for Back-end SSL Service Group ssl_svcg: Session Reuse: ENABLED Timeout: 300 seconds Server Auth: DISABLED Non FIPS Ciphers: DISABLED SSLv3: ENABLED TLSv1: ENABLED 1) Cipher Name: ALL Description: Predefined Cipher Alias Related Commands set ssl serviceGroup unset ssl serviceGroup
set ssl vserver

Synopsis set ssl vserver <vServerName>@ [-clearTextPort <port>] [-dh ( ENABLED | DISABLED ) -dhFile <string>] [dhCount <positive_integer>] [-eRSA ( ENABLED | DISABLED ) [-eRSACount <positive_integer>]] [-sessReuse ( ENABLED | DISABLED ) [-sessTimeout <positive_integer>]] [-cipherRedirect ( ENABLED | DISABLED ) [cipherURL <URL>]] [-sslv2Redirect ( ENABLED | DISABLED ) [-sslv2URL <URL>]] [-clientAuth ( ENABLED | DISABLED ) [-clientCert ( Mandatory | Optional )]] [-sslRedirect ( ENABLED | DISABLED )] [-redirectPortRewrite ( ENABLED | DISABLED )] [-nonFipsCiphers ( ENABLED | DISABLED )] [-ssl2 ( ENABLED | DISABLED )] [ssl3 ( ENABLED | DISABLED )] [-tls1 ( ENABLED | DISABLED )] [-SNIEnable ( ENABLED | DISABLED )] [pushEncTrigger <pushEncTrigger>] Description Set Advance SSL Configurations for an SSL virtual server. Arguments vServerName The name of the SSL virtual server. clearTextPort The port on the back-end web-servers where the clear-text data is sent by system. Use this setting for the wildcard IP based SSL Acceleration configuration (*:443). Minimum value: 1 dh The state of DH key exchange support for the specified SSL virtual server. Possible values: ENABLED, DISABLED Default value: DISABLED dhCount The refresh count for the re-generation of DH public-key and private-key from the DH parameter. Zero means infinite usage (no refresh). Note: The '-dh' argument must be enabled if this argument is specified. Maximum value: 65534 eRSA The state of Ephemeral RSA key exchange support for the SSL virtual server. Ephemeral RSA is used for export ciphers Possible values: ENABLED, DISABLED Default value: ENABLED sessReuse The state of session re-use support for the SSL virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED cipherRedirect The state of Cipher Redirect feature.Cipher Redirect feature can be used to provide more readable information to SSL clients about mismatch in ciphers between the client and the SSL vserver. Possible values: ENABLED, DISABLED Default value: DISABLED sslv2Redirect The state of SSLv2 Redirect feature.SSLv2 Redirect feature can be used to provide more readable information to SSL client about non-support of SSLv2 protocol on the SSL vserver. Possible values: ENABLED, DISABLED Default value: DISABLED clientAuth The state of Client-Authentication support for the SSL virtual server. Possible values: ENABLED, DISABLED Default value: DISABLED sslRedirect The state of HTTPS redirects for the SSL virtual server. This is required for proper working of the redirect messages from the web server. The redirect message from the server gives the new location for the moved object. This is contained in the HTTP header field: Location (for example, Location: http://www.moved.org/here.html). For an SSL session, if the client browser receives this message,
the browser will try to connect to the new location. This will break the secure SSL session, as the object has moved from a secure site (https://) to an unsecured one (http://). Browsers usually flash a warning message on the screen and prompt the user to either continue or disconnect. When the above feature is enabled, all such http:// redirect messages are automatically converted to https://. This does not break the client SSL session. Possible values: ENABLED, DISABLED Default value: DISABLED redirectPortRewrite The state of port in rewrite while performing HTTPS redirect. When this setting is ENABLED on a SSL virtual server, the NetScaler rewrites the port by using the port settings of the content switching virtual server. Possible values: ENABLED, DISABLED Default value: DISABLED nonFipsCiphers The state of usage of non FIPS approved ciphers. Valid only for an SSL vserver bound with a FIPS key and certificate. Possible values: ENABLED, DISABLED Default value: DISABLED ssl2 The state of SSLv2 protocol support for the SSL virtual server. Possible values: ENABLED, DISABLED Default value: DISABLED ssl3 The state of SSLv3 protocol support for the SSL virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED tls1 The state of TLSv1 protocol support for the SSL virtual server. Possible values: ENABLED, DISABLED Default value: ENABLED SNIEnable state of SNI feature on virtual server Possible values: ENABLED, DISABLED Default value: DISABLED pushEncTrigger PUSH packet triggering encryption Always - Any PUSH packet triggers encryption Ignore - Ignore PUSH packet for triggering encryption Merge - For consecutive sequence of PUSH packets, last PUSH packet triggers encryption Timer - PUSH packet triggering encryption delayed by timer period defined in 'set ssl parameter' Possible values: Always, Merge, Ignore, Timer Example 1) set ssl vserver sslvip -dh ENABLED -dhFile /siteA/dh1024.pem -dhCount 500 The above example set the DH parameters for the SSL virtual server 'sslvip'. 3) set ssl vserver sslvip -ssl2 DISABLED The above example disables the support for SSLv2 protocol for the SSL virtual server 'sslvip'.
Related Commands unset ssl vserver bind ssl vserver unbind ssl vserver show ssl vserver
unset ssl vserver

Synopsis unset ssl vserver <vServerName>@ [-clearTextPort] [-dh] [-dhFile] [-dhCount] [-eRSA] [-eRSACount] [-sessReuse] [-sessTimeout] [-cipherRedirect] [-cipherURL] [-sslv2Redirect] [-sslv2URL] [-clientAuth] [-clientCert] [-sslRedirect] [-redirectPortRewrite] [-nonFipsCiphers] [-ssl2] [-ssl3] [-tls1] [-SNIEnable] Description Use this command to remove ssl vserver settings.Refer to the set ssl vserver command for meanings of the arguments. Arguments Example Related Commands set ssl vserver bind ssl vserver unbind ssl vserver show ssl vserver
bind ssl vserver

Synopsis bind ssl vserver <vServerName>@ ((-policyName <string> [-priority <positive_integer>] [-gotoPriorityExpression <expression>] [-invoke (<labelType> <labelName>) ] ) | (-certkeyName <string> [(-CA [-crlCheck ( Mandatory | Optional ) | -ocspCheck ( Mandatory | Optional )]) | -SNICert] )) Description Bind a SSL certkey or a SSL policy to a SSL virtual server. Arguments vServerName The name of the SSL virtual server to which the SSL policy needs to be bound. policyName The name of the SSL policy. certkeyName The name of the CertKey Example 1. bind ssl vserver ssl_vip -certkeyName cert1 In the above example the certificate cert1 is bound to the SSL vserver ssl_vip as server certificate. 2. bind ssl vserver ssl_vip -certkeyName cert2 -CA In the above example the certificate cert2 is bound to the SSL vserver ssl_vip as CA certificate. 3. bind ssl vserver ssl_vip -certkeyName cert3 -CA -ocspCheck Mandatory In the above example the certificate cert3 is bound to the SSL vserver ssl_vip as CA certificate, with OCSP check set to Mandatory. 4. bind ssl vserver ssl_vip -policyName certInsert_pol -priority 10 In the above example the SSL policy certInsert_pol is bound to the SSL vserver ssl_vip with priority 10. Related Commands set ssl vserver
unset ssl vserver unbind ssl vserver show ssl vserver
unbind ssl vserver

Synopsis unbind ssl vserver <vServerName>@ ((-policyName <string> [-priority <positive_integer>]) | (-certkeyName <string> [(-CA [-crlCheck ( Mandatory | Optional )]) | -SNICert] )) Description Unbind a SSL policy from a SSL virtual server. Arguments vServerName The name of the SSL virtual server from which the SSL policy needs to be unbound. policyName The name of the SSL policy. certkeyName The name of the certificate key pair binding. Example unbind ssl vserver ssl_vip -policyName certInsert_pol Related Commands set ssl vserver unset ssl vserver bind ssl vserver show ssl vserver
show ssl vserver

Synopsis show ssl vserver [<vServerName>] [-cipherDetails] Description Display all the SSL specific configurations for an SSL virtual server. This includes information about the Advance SSL configurations, certificate bindings, and cipher-suite configurations. Arguments vServerName The name of the SSL virtual server. cipherDetails Details of the individual ciphers bound to the SSL vserver. Select this flag value to display the details of the individual ciphers bound to the SSL vserver. summary fullValues format level
clearTextPort The clearTextPort settings. dh The state of Diffie-Hellman (DH) key exchange support. dhFile The file name and path for the DH parameter. dhCount The refresh count for the re-generation of DH public-key and private-key from the DH parameter. eRSA The state of Ephemeral RSA key exchange support.Ephemeral RSA is used for export ciphers eRSACount The refresh count for the re-generation of RSA public-key and private-key pair. sessReuse The state of session re-use support. sessTimeout The Session timeout value in seconds. cipherRedirect The state of Cipher Redirect feature.Cipher Redirect feature can be used to provide more readable information to SSL clients about mismatch in ciphers between the client and the SSL vserver. crlCheck The state of the CRL check parameter. (Mandatory/Optional) cipherURL The redirect URL to be used with the Cipher Redirect feature. sslv2Redirect The state of SSLv2 Redirect feature. SSLv2 Redirect feature can be used to provide more readable information to SSL client about non-support of SSLv2 protocol on the SSL vserver. sslv2URL The redirect URL to be used with SSLv2 Redirect feature. clientAuth The state of Client-Authentication support. clientCert The rule for client certificate requirement in client authentication. sslRedirect The state of HTTPS redirect feature support. priority The priority of the policies bound to this SSL service polinherit Whether the bound policy is a inherited policy or not redirectPortRewrite The state of port rewrite feature support. nonFipsCiphers The state of usage of non FIPS approved ciphers. ssl2
The state of SSLv2 protocol support. ssl3 The state of SSLv3 protocol support. tls1 The state of TLSv1 protocol support. SNIEnable The state of SNI extension.Server Name Indication (SNI) helps to enable SSL encryption on multiple subdomains if the domains are controlled by the same organization and share the same second-level domain name. State of SNI feature on service cipherAliasName/cipherName/cipherGroupName The name of the cipher group/alias/individual cipheri bindings. description The cipher suite description. service Service certkeyName The name of the certificate key pair binding. policyName The name of the SSL policy binding. serviceName Service name. ocspCheck The state of the OCSP check parameter. (Mandatory/Optional) pushEncTrigger PUSH packet triggering encryption: Always, Ignore, Merge gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. stateflag count Example An example of the output of the show vserver sslvip command is as follows: sh ssl vserver va1 Advanced SSL configuration for VServer va1: DH: DISABLED Ephemeral RSA: ENABLED Refresh Count: 0 Session Reuse: ENABLED Timeout: 120 seconds Cipher Redirect: DISABLED SSLv2 Redirect: DISABLED ClearText Port: 0 Client Auth: DISABLED SSL Redirect: DISABLED Non FIPS Ciphers: DISABLED SSLv2: DISABLED SSLv3: ENABLED TLSv1: ENABLED 1 bound certificate: 1) CertKey Name: buy Server Certificate 1 bound CA certificate: 1) CertKey Name: rtca CA Certificate 1) Cipher Name: DEFAULT Description: Predefined Cipher Alias Related Commands bind ssl certkey bind ssl cipher set ssl vserver
unset ssl vserver bind ssl vserver unbind ssl vserver
enable ssl fipsSIMTarget

Synopsis enable ssl fipsSIMTarget <keyVector> <sourceSecret> Description Enable the target FIPS system to participate in secure exchange of keys with another FIPS system. The command is used for secure transfer of FIPS keys from the Primary system to the Secondary system. Arguments keyVector The file name and path for storing the target FIPS system's key-vector. The default output path for the secret data is /nsconfig/ssl/. sourceSecret The file name and path for the source FIPS system's secret data. The default input path for the secret data is /nsconfig/ssl/. Example enable fipsSIMtarget /nsconfig/ssl/target.key /nsconfig/ssl/source.secret
Related Commands init ssl fipsSIMTarget
init ssl fipsSIMTarget

Synopsis init ssl fipsSIMTarget <certFile> <keyVector> <targetSecret> Description Initialize the target FIPS system for participating in secure exchange of keys with another FIPS system. The command is used for secure transfer of FIPS keys from the primary system to the Secondary system. Arguments certFile The source FIPS system's certificate file name and path. The default input path for the certificate file is /nsconfig/ssl/. keyVector The file name and path for storing the target FIPS system's key-vector. The default output path for the key-vector is /nsconfig/ssl/. targetSecret The file name and path for storing the target FIPS system's secret data. The default output path for the secret data is /nsconfig/ssl/.
Example init fipsSIMtarget /nsconfig/ssl/source.cert /nsconfig/ssl/target.key /nsconfig/ssl/target.secret
Related Commands enable ssl fipsSIMTarget
enable ssl fipsSIMSource

Synopsis enable ssl fipsSIMSource <targetSecret> <sourceSecret> Description Enable the source FIPS system for participating in secure exchange of keys with another FIPS system. The command is used for secure transfer of FIPS keys from the Primary system to the Secondary system. Arguments targetSecret The file name and path for the target FIPS system's secret data. The default input path for the secret data is /nsconfig/ssl/. sourceSecret The file name and path for storing the source FIPS system's secret data. The default output path for the secret data is /nsconfig/ssl/. Example enable fipsSIMsource /nsconfig/ssl/target.secret /nsconfig/ssl/source.secret
Related Commands init ssl fipsSIMSource
init ssl fipsSIMSource

Synopsis init ssl fipsSIMSource <certFile> Description Initialize the source FIPS system for participating in secure exchange of keys with another FIPS system. The command is used for secure transfer of FIPS keys from the primary system to the secondary system. Arguments certFile The file name and path where the source FIPS system's certificate is to be stored. The default output path for the certificate file is /nsconfig/ssl/. Example init fipsSIMsource /nsconfig/ssl/source.cert
Related Commands enable ssl fipsSIMSource
bind ssl global

Synopsis bind ssl global [-policyName <string>] [-priority <positive_integer>] [-gotoPriorityExpression <expression>] [-type <type>] [-invoke (<labelType> <labelName>) ] Description Bind an SSL policy globally. Arguments policyName The name of the SSL policy. Example bind ssl global -policyName certInsert_pol -priority 100 Related Commands unbind ssl global show ssl global
unbind ssl global

Synopsis unbind ssl global [-policyName <string> [-type <type>] [-priority <positive_integer>]] Description Unbind a globally bound SSL policy. Arguments policyName The name of the SSL policy. Example unbind ssl global -policyName certInsert_pol Related Commands bind ssl global show ssl global
show ssl global

Synopsis show ssl global [-type <type>]
Description Display globally bound SSL policies. Arguments type The bindpoint to which policy is bound. Possible values: CONTROL_OVERRIDE, CONTROL_DEFAULT, DATA_OVERRIDE, DATA_DEFAULT summary fullValues format level stateflag policyName The name for the SSL policy. priority The priority of the policy binding. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE invoke Invoke flag. This attribute is relevant only for ADVANCED policies labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. numpol The number of policies bound to the bindpoint. count Example show ssl global 1 Globally Active SSL Policy: 1) Name: certInsert_pol Priority: 100
Related Commands bind ssl global unbind ssl global
Chapter
38
Stream Commands
Topics: add stream selector set stream selector rm stream selector show stream selector add stream identifier set stream identifier unset stream identifier rm stream identifier show stream identifier stat stream identifier clear stream session
1202 | Citrix NetScaler 10 | Stream Commands
add stream selector

Synopsis add stream selector <name> <rule> ... Description Create stream selectors. A selector is an abstraction for a collection of PIXL expressions. Arguments name The name of stream selector. rule The set of PIXL expressions. Example add stream selector sel_subnet HTTP.REQ.URL CLIENT.IP.SRC.SUBNET(24)
Related Commands set stream selector rm stream selector show stream selector
set stream selector

Synopsis set stream selector <name> -rule <expression> ... Description Change the set of expressions associated with the stream selector. Arguments name The name of stream selector. rule The set of PIXL expressions. Example set stream sel_subnet HTTP.REQ.URL CLIENT.IP.SRC
Related Commands add stream selector rm stream selector show stream selector
Citrix NetScaler 10 | Stream Commands | 1203
rm stream selector
Synopsis rm stream selector <name> Description The command deletes the stream selector. Arguments name The name of stream selector. Example rm stream selector sel_subnet Related Commands add stream selector set stream selector show stream selector
show stream selector

Synopsis show stream selector [<name>] Description Display selectors. Arguments name The name of stream selector. summary fullValues format level rule The set of PIXL expressions. flags count stateflag Example show ns limitSelector sel_subnet
Related Commands add stream selector set stream selector rm stream selector
add stream identifier

Synopsis add stream identifier <name> <selectorName> [-interval <positive_integer>] [-SampleCount <positive_integer>] [sort <sort>] Description
Arguments name The name of stream identifier. selectorName The name of stream selector. interval Time interval in minutes for holding on the objects. Default value: 1 Minimum value: 1 SampleCount Sample count 1 in sample count objects to be sampled. Default value: 1 Minimum value: 1 sort Attribute on which the objects will be sorted on which summarized expressions will be performed. Possible values: REQUESTS, CONNECTIONS, RESPTIME, BANDWIDTH, NONE Default value: STREAM_DIMENSION_REQUESTS Example
Related Commands set stream identifier unset stream identifier rm stream identifier show stream identifier stat stream identifier
set stream identifier

Synopsis set stream identifier <name> [-selectorName <string>] [-interval <positive_integer>] [-SampleCount <positive_integer>] [-sort <sort>] Description
Arguments name
The name of stream identifier. selectorName The name of stream selector. interval Time interval in minutes for holding on the objects. Default value: 1 Minimum value: 1 SampleCount Sample count 1 in sample count objects to be sampled. Default value: 1 Minimum value: 1 sort Attribute on which the objects will be sorted on which summarized expressions will be performed. Possible values: REQUESTS, CONNECTIONS, RESPTIME, BANDWIDTH, NONE Default value: STREAM_DIMENSION_REQUESTS Example
Related Commands add stream identifier unset stream identifier rm stream identifier show stream identifier stat stream identifier
unset stream identifier

Synopsis unset stream identifier <name> [-selectorName] [-interval] [-SampleCount] [-sort] Description Use this command to remove stream identifier settings.Refer to the set stream identifier command for meanings of the arguments. Arguments Example
Related Commands add stream identifier set stream identifier rm stream identifier show stream identifier stat stream identifier
rm stream identifier
Synopsis rm stream identifier <name>
Description
Arguments name The name of stream identifier. Example
Related Commands add stream identifier set stream identifier unset stream identifier show stream identifier stat stream identifier
show stream identifier

Synopsis show stream identifier [<name>] Description
Arguments name The name of stream identifier. summary fullValues format level selectorName The name of stream selector. recordlimit Maximum number of objects allowed per identifier. interval Time interval in minutes for holding on the objects. SampleCount Sample count 1 in sample count objects to be sampled. sort Attribute on which the objects will be sorted on which summarized expressions will be performed. log
Location where objects collected on the identifier will be logged. logInterval Time interval in minutes for logging the collected objects. Log interval should be greater than or equal to the inteval of the stream identifier. logLimit Maximum number of objects to be logged in the log interval. rule Rule. flags used internally to identify ip addresses returned. count stateflag Example
Related Commands add stream identifier set stream identifier unset stream identifier rm stream identifier stat stream identifier
stat stream identifier

Synopsis stat stream identifier <name> [<pattern> ...] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] [-sortBy <sortBy> [<sortOrder>]] Description Display statistics of a identifier. Arguments name The name of the identifier. pattern Pattern for the selector field, ? means field is required, * means field value does not matter, anything else is a regular pattern sortBy count devno stateflag Stream Session Requests (Req)
Total number of Stream Requests recieved. Stream Session Bandwidth (BandW) Total Bandwidth consumed. Stream Session Response Time (RspTime) Average response time of the stream session. Stream Session Connections (Conn) Current connections on the stream session. Example
Related Commands add stream identifier set stream identifier unset stream identifier rm stream identifier show stream identifier
clear stream session

Synopsis clear stream session <name> Description
Arguments name The name of the identifier. Example
Related Commands
Chapter
39
System Commands
Topics: stat system add system cmdPolicy rm system cmdPolicy set system cmdPolicy show system cmdPolicy add system user rm system user set system user unset system user bind system user unbind system user show system user add system group rm system group bind system group unbind system group show system group set system group unset system group show system session kill system session stat system cpu stat system memory rm system entitydata show system entitydata show system entity show system globaldata show system counters show system countergroup show system eventhistory show system core show system dataSource bind system global unbind system global show system global set system collectionparam
1210 | Citrix NetScaler 10 | System Commands
unset system collectionparam show system collectionparam set system parameter unset system parameter show system parameter
Citrix NetScaler 10 | System Commands | 1211
stat system
Synopsis stat system [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description This command displays system statistics Arguments Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system. CPU usage (CPU) CPU utilization percentage. Average CPU usage (CPU) Average CPU utilization percentage. CPU1 CPU 1 (currently the slave CPU) utilization, as percentage of capacity. Not applicable for a singleCPU system. CPU0 CPU 0 (currently the master CPU) utilization, as percentage of capacity. Voltage 7 (Volts) (volt7) Voltage of a device connected to health monitoring chip through pin 7. Voltage 6 (Volts) (volt6) Voltage of a device connected to health monitoring chip through pin 6. Voltage 5 (Volts) (volt5) Voltage of a device connected to health monitoring chip through pin 5. Voltage 4 (Volts) (volt4) Voltage of a device connected to health monitoring chip through pin 4. Voltage 3 (Volts) (volt3) Voltage of a device connected to health monitoring chip through pin 3. Voltage 2 (Volts) (volt2) Voltage of a device connected to health monitoring chip through pin 2. Voltage 1 (Volts) (volt1) Voltage of a device connected to health monitoring chip through pin 1. Voltage 0 (Volts) (volt0) Voltage of a device connected to health monitoring chip through pin 0. Voltage Sensor2(Volts) (VSEN2) Voltage Sensor 2 Input. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0. 5V Standby Voltage(Volts) (V5SB) Power Supply 5V Standby Voltage. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0. Intel CPU Vtt Power(Volts) (VTT) Intel CPU Vtt power. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0.
Battery Voltage (Volts) (VBAT) Onboard battery power supply output. 9800 and 9950 platforms display standard value of 5.0V. -12.0 V Supply Voltage (V12n) Power supply -12V output. Acceptable range is -13.20 through -10.80 volts. 9800 and 9960 platforms display standard value of -12.0V. +12.0 V Supply Voltage (V+12) Power supply +12V output. Acceptable range is 10.80 through 13.20 volts. -5.0 V Supply Voltage (V50n) Power supply -5V output. Acceptable range is -5.50 through -4.50 volts. 9800 and 9960 platforms display standard value of -5.0V. +5.0 V Supply Voltage (V50) Power supply +5V output. Acceptable range is 4.50 through 5.50 volts. Standby 3.3 V Supply Voltage (V33Stby) Standby power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. 9800 and 9960 platforms display standard value of 3.3V. You can configure Standby 3.3V Supply Voltage by using the Set snmp alarm VOLTAGE-LOW command to set the lower limit and the Set snmp alarm VOLTAGE-HIGH command to set the upper limit. Main 3.3 V Supply Voltage (V33Main) Main power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. This is a critical counter. You can configure Main 3.3V Supply Voltage, by using the Set snmp alarm VOLTAGELOW command to set the lower limit and the Set snmp alarm VOLTAGE-HIGH command to set the upper limit. CPU 1 Core Voltage (Volts) (VCC1) CPU core 1 voltage. Acceptable range is 1.080 through 1.650 volts. If CPU 1 is not connected to the health monitoring chip, display shows voltage of CPU 0. CPU 0 Core Voltage (Volts) (VCC0) CPU core 0 voltage. Acceptable range is 1.080 through 1.650 volts. Number of CPUs (CPUs) The number of CPUs on the NetScaler appliance. InUse Memory (%) (MemUsage) Percentage of memory utilization on NetScaler. Memory usage (MB) (MemUseMB) Main memory currently in use, in megabytes. Management CPU usage (%) (CPU) Management CPU utilization percentage. Packet CPU usage (%) (CPU) Packet CPU utilization percentage. CPU usage (%) (CPU) CPU utilization percentage. Average CPU usage (%) (CPU) Average CPU utilization percentage. Up since (Since) Time when the NetScaler appliance was last started. /flash Used (%) (disk0PerUsage)
Used space in /flash partition of the disk, as a percentage. This is a critical counter. You can configure /flash Used (%) by using the Set snmp alarm DISK-USAGE-HIGH command. /var Used (%) (disk1PerUsage) Used space in /var partition of the disk, as a percentage. This is a critical counter. You can configure /var Used (%) by using the Set snmp alarm DISK-USAGE-HIGH command. CPU Fan 0 Speed (RPM) (CPUFan0) CPU Fan 0 speed. Acceptable range is 3000 through 6000 RPM. This is a critical counter. You can configure CPU Fan 0 Speed by using the Set snmp alarm FAN-SPEED-LOW command to set the lower limit. CPU Fan 1 Speed (RPM) (CPUFan1) CPU Fan 1 speed. Acceptable range is 3000 through 6000 RPM. 7000 platform displays speed of CPU fan 0. This is a critical counter. You can configure CPU Fan 1 Speed by using the Set snmp alarm FAN-SPEED-LOW command to set the lower limit. System Fan Speed (RPM) (systemFan) System fan speed. Acceptable range is 3000 through 6000 RPM. This is a critical counter. You can configure System Fan Speed by using the Set snmp alarm FAN-SPEED-LOW command to set the lower limit. System Fan 1 Speed (RPM) (systemFan1) System fan 1 speed. For new platforms associated pin is connected to CPU supporting fans. For platforms in which it is not connected, it will point to System Fan. System Fan 2 Speed (RPM) (systemFan2) System fan 2 speed. For new platforms associated pin is connected to CPU supporting fans. For platforms in which it is not connected, it will point to System Fan CPU 0 Temperature (Celsius) (TCPU0) CPU 0 temperature. 9800 and 9960 platforms display internal chip temperature. This is a critical counter. You can configure CPU 0 Temperature by using the Set snmp alarm TEMPERATUREHIGH command to set the upper limit. CPU 1 Temperature (Celsius) (TCPU1) CPU 1 temperature. 9800 and 9960 platforms display internal chip temperature. 7000, 9010 and 10010 platforms display CPU 0 temperature. This is a critical counter. You can configure CPU 1 Temperature by using the Set snmp alarm TEMPERATURE-HIGH command to set the upper limit. Internal Temperature (Celsius) (intTemp) Internal temperature of health monitoring chip. This is a critical counter. You can configure Internal Temperature by using the Set snmp alarm TEMPERATURE-HIGH command to set the upper limit. Power supply 1 status (PS1FAIL) Power supply 1 failure status. Power supply 2 status (PS2FAIL) Power supply 2 failure status. /flash Size (MB) (disk0Size) Size of /flash partition of the hard disk. /flash Used (MB) (disk0Used) Used space in /flash partition of the hard disk. /flash Available (MB) (disk0Avail) Available space in /flash partition of the hard disk. /var Size (MB) (disk1Size) Size of /var partition of the hard disk.
/var Used (MB) (disk1Used) Used space in /var partition of the hard disk. /var Available (MB) (disk1Avail) Available space in /var partition of the hard disk. Fan 0 Speed (RPM) (Fan0) Speed of Fan 0 if associated pin is connected to health monitoring chip. Fan 1 Speed (RPM) (Fan1) Speed of Fan 1 if associated pin is connected to health monitoring chip. Fan 2 Speed (RPM) (Fan2) Speed of Fan 2 if associated pin is connected to health monitoring chip. Fan 3 Speed (RPM) (Fan3) Speed of Fan 3 if associated pin is connected to health monitoring chip. Temperature 0 (Celsius) (temp0) Temperature of a device connected to health monitoring chip through pin 0. Temperature 1 (Celsius) (temp1) Temperature of a device connected to health monitoring chip through pin 1. Temperature 2 (Celsius) (temp2) Temperature of a device connected to health monitoring chip through pin 2. Temperature 3 (Celsius) (temp3) Temperature of a device connected to health monitoring chip through pin 3. Up time (UP) Seconds since the NetScaler appliance started. System memory (MB) (Memory) Total amount of system memory, in megabytes. CPU usage (CPU) CPU utilization: percentage * 10. Management CPU usage (CPU) Management CPU utilization: percentage * 10. CPU 0 Core Voltage (Volts) (VCC0) CPU core 0 voltage. Acceptable range is 1.080 through 1.650 volts. CPU 1 Core Voltage (Volts) (VCC1) CPU core 1 voltage. Acceptable range is 1.080 through 1.650 volts. If CPU 1 is not connected to the health monitoring chip, display shows voltage of CPU 0. Main 3.3 V Supply Voltage (V33Main) Main power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. This is a critical counter. You can configure Main 3.3V Supply Voltage, by using the Set snmp alarm VOLTAGELOW command to set the lower limit and the Set snmp alarm VOLTAGE-HIGH command to set the upper limit. Standby 3.3 V Supply Voltage (V33Stby) Standby power supply +3.3V output. Acceptable range is 2.970 through 3.630 volts. 9800 and 9960 platforms display standard value of 3.3V. You can configure Standby 3.3V Supply Voltage by using the Set snmp alarm VOLTAGE-LOW command to set the lower limit and the Set snmp alarm VOLTAGE-HIGH command to set the upper limit. +5.0 V Supply Voltage (V50)
Power supply +5V output. Acceptable range is 4.50 through 5.50 volts. -5.0 V Supply Voltage (V50n) Power supply -5V output. Acceptable range is -5.50 through -4.50 volts. 9800 and 9960 platforms display standard value of -5.0V. +12.0 V Supply Voltage (V+12) Power supply +12V output. Acceptable range is 10.80 through 13.20 volts. -12.0 V Supply Voltage (V12n) Power supply -12V output. Acceptable range is -13.20 through -10.80 volts. 9800 and 9960 platforms display standard value of -12.0V. Battery Voltage (Volts) (VBAT) Onboard battery power supply output. 9800 and 9950 platforms display standard value of 5.0V. Intel CPU Vtt Power(Volts) (VTT) Intel CPU Vtt power. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0. 5V Standby Voltage(Volts) (V5SB) Power Supply 5V Standby Voltage. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0. Voltage Sensor2(Volts) (VSEN2) Voltage Sensor 2 Input. Currently only 13k Platforms will have valid value for this counter and for older platforms this will be 0. Voltage 0 (Volts) (volt0) Voltage of a device connected to health monitoring chip through pin 0. Voltage 1 (Volts) (volt1) Voltage of a device connected to health monitoring chip through pin 1. Voltage 2 (Volts) (volt2) Voltage of a device connected to health monitoring chip through pin 2. Voltage 3 (Volts) (volt3) Voltage of a device connected to health monitoring chip through pin 3. Voltage 4 (Volts) (volt4) Voltage of a device connected to health monitoring chip through pin 4. Voltage 5 (Volts) (volt5) Voltage of a device connected to health monitoring chip through pin 5. Voltage 6 (Volts) (volt6) Voltage of a device connected to health monitoring chip through pin 6. Voltage 7 (Volts) (volt7) Voltage of a device connected to health monitoring chip through pin 7. Master CPU usage (CPU0) CPU0 utilization: percentage * 10. Slave CPU usage (CPU1) CPU1 utilization, percentage * 10. Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system.
Example
Related Commands stat system cpu stat system memory
add system cmdPolicy

Synopsis add system cmdPolicy <policyName> <action> <cmdSpec> Description Add a system command Policy to the system. Arguments policyName The name for the command policy. action The action the policy need to apply when the cmdSpec pattern matches. Possible values: ALLOW, DENY cmdSpec The matching rule that the policy will utilize. This rule is a regular expression which the policy uses to pattern match. Example
Related Commands rm system cmdPolicy set system cmdPolicy show system cmdPolicy
rm system cmdPolicy
Synopsis rm system cmdPolicy <policyName> Description Remove a system command policy. Arguments policyName The name of the policy. Example
Related Commands add system cmdPolicy set system cmdPolicy show system cmdPolicy
set system cmdPolicy

Synopsis set system cmdPolicy <policyName> <action> <cmdSpec> Description Modify an already configured command Policy. Arguments policyName The name for the command policy. action The action the policy need to apply when the cmdSpec pattern matches. Possible values: ALLOW, DENY cmdSpec The matching rule that the policy will utilize. This rule is a regular expression which the policy uses to pattern match. Example
Related Commands add system cmdPolicy rm system cmdPolicy show system cmdPolicy
show system cmdPolicy

Synopsis show system cmdPolicy [<policyName>] Description Display configured command policies. Arguments policyName The name of a policy. summary fullValues format
level action The policy action. cmdSpec The matching rule that the policy will utilize. count stateflag Example
Related Commands add system cmdPolicy rm system cmdPolicy set system cmdPolicy
add system user

Synopsis add system user <userName> [-promptString <string>] [-timeout <secs>] Description Add a new system user to the system. Arguments userName The name for the system user. password The system user's password. promptString The system user's prompt. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Maximum value: 100000000 Example
Related Commands rm system user set system user unset system user show system user
rm system user
Synopsis rm system user <userName> Description Remove a system user. Arguments userName The name of the system user. Example
Related Commands add system user set system user unset system user show system user
set system user

Synopsis set system user <userName> {-password } [-promptString <string>] [-timeout <secs>] Description Set a system user's password. Arguments userName The name for the system user. password The system user's password. promptString The system user's prompt. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Maximum value: 100000000 Example
Related Commands add system user rm system user
unset system user show system user
unset system user

Synopsis unset system user <userName> [-promptString] [-timeout] Description Use this command to remove system user settings.Refer to the set system user command for meanings of the arguments. Arguments Example
Related Commands add system user rm system user set system user show system user
bind system user

Synopsis bind system user <userName> <policyName> <priority> Description Bind the command policy to a system user. Arguments userName The name of the system user. policyName The name of the command policy being bound to the system user. Example
Related Commands unbind system user
unbind system user

Synopsis unbind system user <userName> <policyName>
Description Unbind attributes of a system user. Arguments userName The name of the system user. policyName The name of the command policy to be unbound. Example
Related Commands bind system user
show system user

Synopsis show system user [<userName>] Description Display configured system users. Arguments userName The name of a system user. summary fullValues format level groupName The system group. policyName The name of command policy. priority The priority of the policy. promptString The system user's prompt. promptInheritedFrom From where the prompt has been inherited. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. timeoutKind From where the timeout has been inherited.
count stateflag Example
Related Commands add system user rm system user set system user unset system user
add system group

Synopsis add system group <groupName> [-promptString <string>] [-timeout <secs>] Description Add a new system group. Arguments groupName The name of system group. promptString The system group's prompt. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Maximum value: 100000000 Example
Related Commands rm system group show system group set system group unset system group
rm system group
Synopsis rm system group <groupName> Description Remove a system group.
Arguments groupName The name of the system group. Example
Related Commands add system group show system group set system group unset system group
bind system group

Synopsis bind system group <groupName> [-userName <string>] [-policyName <string> <priority>] Description Bind entities to a system group. Arguments groupName The name of the system group. userName The name of a system user to be bound to the group. policyName The name of the command policy to be bound to the group. Example
Related Commands unbind system group
unbind system group

Synopsis unbind system group <groupName> [-userName <string>] [-policyName <string>] Description Unbind entities from a system group. Arguments groupName The system group name. userName
The name of a system user to be unbound from the group. policyName The command policy to be be unbound from the group. Example
Related Commands bind system group
show system group

Synopsis show system group [<groupName>] Description Display the configured system groups. Arguments groupName The name of the system group. summary fullValues format level userName The system user. policyName The name of command policy. priority The priority of the command policy. promptString The system group's prompt. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. count stateflag Example
Related Commands add system group rm system group
set system group unset system group
set system group

Synopsis set system group <groupName> [-promptString <string>] [-timeout <secs>] Description Set attributes of a system group. Arguments groupName The name of system group. promptString The system group's prompt. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Maximum value: 100000000 Example
Related Commands add system group rm system group show system group unset system group
unset system group

Synopsis unset system group <groupName> [-promptString] [-timeout] Description Use this command to remove system group settings.Refer to the set system group command for meanings of the arguments. Arguments Example
Related Commands add system group rm system group show system group
set system group
show system session

Synopsis show system session [<sid>] Description Display system sessions. System may reclaim sessions with no active connections before expiry time Arguments sid The session id. Minimum value: 1 summary fullValues userName user name of the session logintime logged-in time of this session lastactivitytime last activity time of on this session expirytime Time left in expire the session in seconds numOfconnections number of connection using this token currentconn True if the token is used for current session count stateflag Example
Related Commands kill system session
kill system session

Synopsis kill system session (<sid> | -all) Description Kill system sessions. Arguments sid
The session id. Minimum value: 1 all Specify this if you want to kill all sessions except self. Example
Related Commands show system session
stat system cpu

Synopsis stat system cpu [<id>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description This command displays CPU statistics Arguments id Specifies the CPU ID. Default value: 65535 Maximum value: 65534 count devno stateflag CPU Usage (Usage) CPU utilization percentage. CPU Usage (Usage) CPU utilization percentage. Example
Related Commands stat system stat system memory
stat system memory

Synopsis stat system memory [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display NetScaler global memory statistics Arguments Shared Memory InUse (%) (shMemAllocpcnt)
Shared memory insue percent. Shared Memory InUse (MB) (shMemAllocMB) Shared memory insue, in megabytes. Total Shared Memory (MB) (shMemtotMB) Total shared memory allowed to allocate, in megabytes. Free Memory (MB) (MemTotFree) Total Free PE Memory in the System. InUse Memory (%) (MemUsage) Percentage of memory utilization on NetScaler. InUse Memory (MB) (MemTotUseMB) Total NetScaler Memory in use, in megabytes. Memory Allocated (%) (MemTotAlloc(%)) Currently allocated memory in percent. Memory Allocated (MB) (MemTotAlloc) Currently allocated memory, in megabytes. Memory Currently Available (MB) (MemTotMB) Total memory available (grabbed) for use by packet engine (PE), in megabytes. Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system. Maximum Memory Available (MB) (MemTotAvail) Total system memory available for PE to grab from the system. Total Shared Memory (MB) (shMemtotMB) Total shared memory allowed to allocate, in megabytes. Shared Memory InUse (MB) (shMemAllocMB) Shared memory insue, in megabytes. Example stat system memory
Related Commands stat system stat system cpu
rm system entitydata
Synopsis rm system entitydata [<type>] [<name>] [-allDeleted] [-allInactive] [-dataSource <string>] [-core <integer>] Description
Arguments type Specify the entity type.
name Specify the entity name. allDeleted Specify this if you would like to deleted all deleted entity database. allInactive Specify this if you would like to deleted all inactive entity database. dataSource Specify data source name. core Specify core. Example
Related Commands show system entitydata
show system entitydata

Synopsis show system entitydata <type> <name> <counters> [-startTime <string> | (-last <integer> [<unit>])] [-endTime <string>] [-dataSource <string>] [-core <integer>] Description Display historical data for global counters. Arguments type Specify the entity type. name Specify the entity name. counters Specify the counters. startTime Specify end time in mmddyyyyhhmm. endTime Specify end time in mmddyyyyhhmm. last Specify the counters. Default value: 1 dataSource Specify Data source name. core Specify core. response startUpdate
lastupdate Example show system entitydata lbvserver v1 totalrequests -last 1 days
Related Commands rm system entitydata
show system entity

Synopsis show system entity <type> [-dataSource <string>] [-core <integer>] Description Display entities in historical data. Arguments type Specify the entity type. dataSource Specify Data source name. core Specify core. response Example show system entity lbvserver
Related Commands
show system globaldata

Synopsis show system globaldata <counters> [<countergroup>] [-startTime <string> | (-last <integer> [<unit>])] [-endTime <string>] [-dataSource <string>] [-core <integer>] Description Display historical data for global counters. Arguments counters Specify the counters. countergroup Specify the counter group. startTime
Specify start time in mmddyyyyhhmm. endTime Specify end time in mmddyyyyhhmm. last Specify the counters. Default value: 1 dataSource Specify data source name. core Specify core. response startUpdate lastupdate Example show system globaldata cpu_usage -last 1 hours
Related Commands
show system counters

Synopsis show system counters [<countergroup>] [-dataSource <string>] Description Display entities in historical data. Arguments countergroup Specify the group name. dataSource Specify Data source name. response Example
Related Commands
show system countergroup

Synopsis show system countergroup [-dataSource <string>] Description Display available counter groups.
Arguments dataSource Specify Data source name. response Example
Related Commands
show system eventhistory

Synopsis show system eventhistory [-startTime <string> | (-last <integer> [<unit>])] [-endTime <string>] -dataSource <string> Description Display events in historical data. Arguments startTime Specify start time in mmddyyyyhhmm. endTime Specify end time in mmddyyyyhhmm. last Specify the counters. Default value: 1 dataSource Specify Data source name. response Example
Related Commands
show system core

Synopsis show system core [-dataSource <string>] Description Display entities in historical data. Arguments dataSource Specify Data source name. response
Example
Related Commands
show system dataSource

Synopsis show system dataSource [<dataSource>] Description Display entities in historical data. Arguments dataSource Specify Data source name. response Example
Related Commands
bind system global

Synopsis bind system global [<policyName> [-priority <positive_integer>]] Description Bind entities to system global. Arguments policyName The name of the command policy to be bound to system global. Example
Related Commands unbind system global show system global
unbind system global

Synopsis unbind system global <policyName>
Description Unbind entities from system global. Arguments policyName The name of the command policy to be unnbound. Example
Related Commands bind system global show system global
show system global

Synopsis show system global Description Display system global bindings. Arguments summary fullValues format level policyName The name of the command policy. priority The priority of the command policy. bindPolicyType Bound policy type policySubType count stateflag Example
Related Commands bind system global unbind system global
set system collectionparam

Synopsis set system collectionparam [-communityName <string>] [-dataPath <string>] Description Set a collection parameters. Arguments communityName dataPath specify the data path Example
Related Commands unset system collectionparam show system collectionparam
unset system collectionparam

Synopsis unset system collectionparam [-communityName] [-dataPath] Description Use this command to remove system collectionparam settings.Refer to the set system collectionparam command for meanings of the arguments. Arguments Example
Related Commands set system collectionparam show system collectionparam
show system collectionparam

Synopsis show system collectionparam Description Display collection parameter
Arguments format level communityName specify the snmp community which is used to collect the data. logLevel specify the log level. Possible values CRITICAL,WARNING,INFO,DEBUG1,DEBUG2 dataPath specify the data path Example
Related Commands set system collectionparam unset system collectionparam
set system parameter

Synopsis set system parameter [-rbaOnResponse ( ENABLED | DISABLED )] [-promptString <string>] [natPcbForceFlushLimit <positive_integer>] [-natPcbRstOnTimeout ( ENABLED | DISABLED )] [-timeout <secs>] Description Set System parameters. Arguments rbaOnResponse specify whether RBA on response is enabled/disabled Possible values: ENABLED, DISABLED Default value: ENABLED promptString The global system CLI prompt. natPcbForceFlushLimit force flush if number of NATPCBs above this Default value: 2147483647 Minimum value: 1000 natPcbRstOnTimeout Send RST to client and server connections when the natpcbs timeout. This avoids the buildup of idle TCP connections on the both the sides. Possible values: ENABLED, DISABLED Default value: DISABLED timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Maximum value: 100000000 Example
Related Commands unset system parameter
show system parameter
unset system parameter

Synopsis unset system parameter [-rbaOnResponse] [-promptString] [-natPcbForceFlushLimit] [-natPcbRstOnTimeout] [timeout] Description Use this command to remove system parameter settings.Refer to the set system parameter command for meanings of the arguments. Arguments Example
Related Commands set system parameter show system parameter
show system parameter

Synopsis show system parameter Description Get System parameters. Arguments format level rbaOnResponse specify whether RBA on response is enabled/disabled promptString The global system prompt. natPcbForceFlushLimit force flush if number of NATPCBs above this natPcbRstOnTimeout Send RST to client and server connections when the natpcbs timeout.This avoids the buildup of idle TCP connections on the both the sides. timeout CLI session inactivity timeout, in seconds. Timeout cannot have values in between 1 and 9. Example
Related Commands set system parameter unset system parameter
Chapter
40
TM Commands
Topics: add tm sessionPolicy rm tm sessionPolicy set tm sessionPolicy unset tm sessionPolicy show tm sessionPolicy add tm sessionAction rm tm sessionAction set tm sessionAction unset tm sessionAction show tm sessionAction add tm trafficPolicy rm tm trafficPolicy set tm trafficPolicy unset tm trafficPolicy show tm trafficPolicy add tm formSSOAction rm tm formSSOAction set tm formSSOAction unset tm formSSOAction show tm formSSOAction add tm trafficAction rm tm trafficAction set tm trafficAction unset tm trafficAction show tm trafficAction bind tm global unbind tm global show tm global set tm sessionParameter unset tm sessionParameter show tm sessionParameter
1240 | Citrix NetScaler 10 | TM Commands
add tm sessionPolicy
Synopsis add tm sessionPolicy <name> <rule> <action> Description Add a tm session policy, which conditionally sets characteristics of a tm session upon session establishment. Arguments name The name for the new tm session policy. rule The rule to be evaluated in the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The action to be performed when the rule is matched. Example
Related Commands rm tm sessionPolicy set tm sessionPolicy unset tm sessionPolicy show tm sessionPolicy
rm tm sessionPolicy
Synopsis rm tm sessionPolicy <name> Description Remove a previously created tm session policy. Arguments name The name of the policy to be removed. Example
Related Commands add tm sessionPolicy set tm sessionPolicy
Citrix NetScaler 10 | TM Commands | 1241
unset tm sessionPolicy show tm sessionPolicy
set tm sessionPolicy
Synopsis set tm sessionPolicy <name> [-rule <expression>] [-action <string>] Description Modify the rule or action of a tm session policy. Arguments name The name of the tm session policy. rule The new rule to be associated with the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new tm session action for the policy. Example
Related Commands add tm sessionPolicy rm tm sessionPolicy unset tm sessionPolicy show tm sessionPolicy
unset tm sessionPolicy
Synopsis unset tm sessionPolicy <name> [-rule] [-action] Description Use this command to remove tm sessionPolicy settings.Refer to the set tm sessionPolicy command for meanings of the arguments. Arguments Example
Related Commands add tm sessionPolicy
rm tm sessionPolicy set tm sessionPolicy show tm sessionPolicy
show tm sessionPolicy
Synopsis show tm sessionPolicy [<name>] Description Display the configured tm session policies. Arguments name The name of the tm session policy. summary fullValues format level rule The new rule associated with the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new tm session action the policy is using. boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag Example
Related Commands add tm sessionPolicy rm tm sessionPolicy set tm sessionPolicy unset tm sessionPolicy
add tm sessionAction
Synopsis add tm sessionAction <name> [-sessTimeout <mins>] [-defaultAuthorizationAction ( ALLOW | DENY )] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-ssoDomain <string>] [-httpOnlyCookie ( YES | NO )] [-persistentCookie ( ENABLED | DISABLED )] [-persistentCookieValidity <mins>] Description Create a session action, which defines the properties of a TM session. Arguments name The name for the new tm session action. sessTimeout The session timeout, in minutes, to be set by the action. Minimum value: 1 defaultAuthorizationAction This toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY SSO Enables or disables the use of Single Sign-on for the session. Possible values: ON, OFF Default value: OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY ssoDomain NT domain to use with SSO httpOnlyCookie whether the session cookie will be httpOnly or not Possible values: YES, NO persistentCookie Whether persistent cookie should be allowed on this TM session Possible values: ENABLED, DISABLED persistentCookieValidity Number of minutes for which the persistent cookie would be valid Minimum value: 1 Example
Related Commands rm tm sessionAction set tm sessionAction unset tm sessionAction show tm sessionAction
rm tm sessionAction
Synopsis rm tm sessionAction <name>
Description Delete a previously created session action. Arguments name The tm session action to be removed. Example
Related Commands add tm sessionAction set tm sessionAction unset tm sessionAction show tm sessionAction
set tm sessionAction
Synopsis set tm sessionAction <name> [-sessTimeout <mins>] [-defaultAuthorizationAction ( ALLOW | DENY )] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-ssoDomain <string>] [-httpOnlyCookie ( YES | NO )] [-persistentCookie ( ENABLED | DISABLED )] [-persistentCookieValidity <positive_integer>] Description Modify a session action, which defines the properties of a TM session. Arguments name The name of the tm session action. sessTimeout The session timeout, in minutes, to be set by the action. Minimum value: 1 defaultAuthorizationAction This toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY SSO Enables or disables the use of Single Sign-on for the session. Possible values: ON, OFF Default value: OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY ssoDomain NT domain to use with SSO httpOnlyCookie whether the session cookie will be httpOnly or not Possible values: YES, NO persistentCookie Whether persistent cookie should be allowed on this TM session Possible values: ENABLED, DISABLED
persistentCookieValidity Number of minutes for which the persistent cookie would be valid Minimum value: 1 Example
Related Commands add tm sessionAction rm tm sessionAction unset tm sessionAction show tm sessionAction
unset tm sessionAction
Synopsis unset tm sessionAction <name> [-sessTimeout] [-defaultAuthorizationAction] [-SSO] [-ssoCredential] [-ssoDomain] [-httpOnlyCookie] [-persistentCookie] [-persistentCookieValidity] Description Use this command to remove tm sessionAction settings.Refer to the set tm sessionAction command for meanings of the arguments. Arguments Example
Related Commands add tm sessionAction rm tm sessionAction set tm sessionAction show tm sessionAction
show tm sessionAction
Synopsis show tm sessionAction [<name>] Description Display tm session action details. Arguments name The name of the tm session action. summary
fullValues format level sessTimeout The session timeout, in minutes, set by the action. defaultAuthorizationAction The Authorization Action, e.g. allow or deny stateflag SSO Whether or not Single Sign-On is used for this session. ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On ssoDomain NT domain to use with SSO httpOnlyCookie whether the session cookie will be httpOnly or not persistentCookie Whether persistent cookie should be allowed on this TM session persistentCookieValidity Number of minutes for which the persistent cookie would be valid count Example
Related Commands add tm sessionAction rm tm sessionAction set tm sessionAction unset tm sessionAction
add tm trafficPolicy
Synopsis add tm trafficPolicy <name> <rule> <action> Description Add a traffic policy. A traffic policy conditionally sets VPN traffic characteristics at run time. Arguments name The name for the new vpn traffic policy. rule
The rule to be used by the vpn traffic policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The action to be applied by the policy if its rule is matched. Example
Related Commands rm tm trafficPolicy set tm trafficPolicy unset tm trafficPolicy show tm trafficPolicy
rm tm trafficPolicy
Synopsis rm tm trafficPolicy <name> Description Remove a vpn traffic policy. Arguments name The name of the vpn traffic policy to be removed. Example
Related Commands add tm trafficPolicy set tm trafficPolicy unset tm trafficPolicy show tm trafficPolicy
set tm trafficPolicy
Synopsis set tm trafficPolicy <name> [-rule <expression>] [-action <string>] Description Change the properties of an existing traffic policy. Arguments name The name of the policy.
rule The new rule to be used in the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new action to be applied by the policy. Example
Related Commands add tm trafficPolicy rm tm trafficPolicy unset tm trafficPolicy show tm trafficPolicy
unset tm trafficPolicy
Synopsis unset tm trafficPolicy <name> [-rule] [-action] Description Use this command to remove tm trafficPolicy settings.Refer to the set tm trafficPolicy command for meanings of the arguments. Arguments Example
Related Commands add tm trafficPolicy rm tm trafficPolicy set tm trafficPolicy show tm trafficPolicy
show tm trafficPolicy
Synopsis show tm trafficPolicy [<name>] Description Display vpn traffic policies. Arguments name
The name of the vpn trafiic policy. summary fullValues format level rule The rule used by the vpn traffic policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide action The action to be performed when the rule is matched. boundTo The entity name to which policy is bound activePolicy priority hits Number of hits. bindPolicyType vserverType count stateflag Example
Related Commands add tm trafficPolicy rm tm trafficPolicy set tm trafficPolicy unset tm trafficPolicy
add tm formSSOAction
Synopsis add tm formSSOAction <name> -actionURL <URL> -userField <string> -passwdField <string> -ssoSuccessRule <expression> [-nameValuePair <string>] [-responsesize <positive_integer>] [-nvtype ( STATIC | DYNAMIC )] [submitMethod ( GET | POST )] Description Create a formsso action. A formsso action defines the characteristics of the form. Arguments name
The name for the action. actionURL The url to which form will be submitted. userField Username field in the form to be filled with sessions username. passwdField Password field in the form to be filled with sessions username. ssoSuccessRule The rule to be used to check whether sso is successfull or not . Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. nameValuePair Name Value pairs to be submitted. Name value pairs have to separated by '&'. EX: name1=value1&name2=value2 responsesize Size of the body to be parsed to get the forms. Default value: 8096 nvtype Bypass Form extraction. Possible values: STATIC, DYNAMIC Default value: NS_ACT_FSSO_NV_DYNAMIC submitMethod submit method Possible values: GET, POST Default value: NS_ACT_FSSO_SUBMIT_GET Example
Related Commands rm tm formSSOAction set tm formSSOAction unset tm formSSOAction show tm formSSOAction
rm tm formSSOAction
Synopsis rm tm formSSOAction <name> Description Delete a previously created session action. Arguments name The Form sso action to be removed. Example
Related Commands add tm formSSOAction set tm formSSOAction unset tm formSSOAction show tm formSSOAction
set tm formSSOAction
Synopsis set tm formSSOAction <name> [-actionURL <URL>] [-userField <string>] [-passwdField <string>] [ssoSuccessRule <expression>] [-responsesize <positive_integer>] [-nameValuePair <string>] [-nvtype ( STATIC | DYNAMIC )] [-submitMethod ( GET | POST )] Description Create a vpn traffic action. A vpn traffic action defines the characteristics of run time VPN traffic. Arguments name The name for the action. actionURL Set the url to which form will be submitted. userField Set the username field. passwdField Set the password field. ssoSuccessRule Set the success rule. responsesize Set the body size to be parsed Default value: 8096 nameValuePair Set the name value pair. nvtype Bypass Form extraction. Possible values: STATIC, DYNAMIC Default value: NS_ACT_FSSO_NV_DYNAMIC submitMethod Submit method. Possible values: GET, POST Default value: NS_ACT_FSSO_SUBMIT_GET Example
Related Commands add tm formSSOAction rm tm formSSOAction unset tm formSSOAction show tm formSSOAction
unset tm formSSOAction
Synopsis unset tm formSSOAction <name> [-responsesize] [-nameValuePair] [-nvtype] [-submitMethod] Description Use this command to remove tm formSSOAction settings.Refer to the set tm formSSOAction command for meanings of the arguments. Arguments Example
Related Commands add tm formSSOAction rm tm formSSOAction set tm formSSOAction show tm formSSOAction
show tm formSSOAction
Synopsis show tm formSSOAction [<name>] Description Display Form SSO action details. Arguments name The name for the action. summary fullValues format level actionURL The url to which form will be submitted. userField Username field. passwdField Password field. responsesize Size of the body to be parsed to get the forms.
nameValuePair Form attributes and their values to be submitted. nvtype Bypass Form extraction ssoSuccessRule Rule to be evaluated to check whether sso succeeded or not. submitMethod Form Submit method. count stateflag Example
Related Commands add tm formSSOAction rm tm formSSOAction set tm formSSOAction unset tm formSSOAction
add tm trafficAction
Synopsis add tm trafficAction <name> [-appTimeout <mins>] [-SSO ( ON | OFF ) [-formSSOAction <string>]] [persistentCookie ( ENABLED | DISABLED )] [-InitiateLogout ( ON | OFF )] Description Create a tm traffic action. A tm traffic action defines the characteristics of run time tm traffic. Arguments name The name for the action. appTimeout The inactivity timeout after which the system closes a connection. Minimum value: 1 Maximum value: 715827 SSO Enable or disable Single Sign-On Possible values: ON, OFF formSSOAction Name of configured tm formssoaction persistentCookie Whether persistent cookie should be allowed on this traffic action Possible values: ENABLED, DISABLED InitiateLogout Initiate Logout on this session Possible values: ON, OFF
Example
Related Commands rm tm trafficAction set tm trafficAction unset tm trafficAction show tm trafficAction
rm tm trafficAction
Synopsis rm tm trafficAction <name> Description Remove a previously created traffic action. Arguments name The name of the action to be removed. Example
Related Commands add tm trafficAction set tm trafficAction unset tm trafficAction show tm trafficAction
set tm trafficAction
Synopsis set tm trafficAction <name> [-appTimeout <mins>] [-SSO ( ON | OFF )] [-formSSOAction <string>] [persistentCookie ( ENABLED | DISABLED )] [-InitiateLogout ( ON | OFF )] Description Modifies a vpn traffic action. A vpn traffic action defines the characteristics of run time VPN traffic. Arguments name The name for the action. appTimeout The inactivity timeout after which the system closes a connection. Minimum value: 1 Maximum value: 715827 SSO
switch to turn on the SSO engine for HTTP traffic. Possible values: ON, OFF formSSOAction Name of configured tm formssoaction persistentCookie Whether persistent cookie should be allowed on this TM session Possible values: ENABLED, DISABLED InitiateLogout switch to turn on the Logout of TM session. Possible values: ON, OFF Example
Related Commands add tm trafficAction rm tm trafficAction unset tm trafficAction show tm trafficAction
unset tm trafficAction
Synopsis unset tm trafficAction <name> -persistentCookie Description Use this command to remove tm trafficAction settings.Refer to the set tm trafficAction command for meanings of the arguments. Arguments Example
Related Commands add tm trafficAction rm tm trafficAction set tm trafficAction show tm trafficAction
show tm trafficAction
Synopsis show tm trafficAction [<name>] Description Display the configured vpn traffic action(s).
Arguments name The name of the vpn trafiic action. summary fullValues format level appTimeout The application timeout SSO Whether or not Single Sign On is enabled. formSSOAction Name of configured tm formssoaction stateflag persistentCookie Whether persistent cookie should be allowed on this traffic action InitiateLogout Whether Logout is initiated with this action count Example
Related Commands add tm trafficAction rm tm trafficAction set tm trafficAction unset tm trafficAction
bind tm global
Synopsis bind tm global [-policyName <string> [-priority <positive_integer>]] Description Bind session/audit policies to tm global. Arguments policyName The name of the policy to be bound to tm global. Example
Related Commands unbind tm global show tm global
unbind tm global
Synopsis unbind tm global -policyName <string> Description Unbind audit/session policies from tm global. Arguments policyName The name of the policy to be unbound. Example
Related Commands bind tm global show tm global
show tm global
Synopsis show tm global Description Display the tm global bindings. Arguments summary fullValues format level policyName The name of the policy. priority The priority of the policy. type Bindpoint to which the policy is bound policySubType stateflag
bindPolicyType Bound policy type count Example
Related Commands bind tm global unbind tm global
set tm sessionParameter
Synopsis set tm sessionParameter [-sessTimeout <mins>] [-defaultAuthorizationAction ( ALLOW | DENY )] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-ssoDomain <string>] [-httpOnlyCookie ( YES | NO )] [persistentCookie ( ENABLED | DISABLED )] [-persistentCookieValidity <positive_integer>] Description Set global parameters for the tm session Arguments sessTimeout The session idle timeout value in minutes. This idle timeout meters the overall network inactivity for a session. Default value: 30 Minimum value: 1 defaultAuthorizationAction The authorization action state. Toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY Default value: NS_ALLOW SSO Whether or not Single Sign-On is used Possible values: ON, OFF Default value: OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY Default value: VPN_SESS_ACT_USE_PRIMARY_CREDENTIALS ssoDomain NT domain to use with SSO httpOnlyCookie whether the session cookie will be httpOnly or not Possible values: YES, NO Default value: VPN_SESS_ACT_HTTPONLYCOOKIE_ALLOW persistentCookie Whether persistent cookie should be allowed on this TM session Possible values: ENABLED, DISABLED Default value: DISABLED persistentCookieValidity Number of minutes for which the persistent cookie would be valid Minimum value: 1 Example
Related Commands unset tm sessionParameter show tm sessionParameter
unset tm sessionParameter
Synopsis unset tm sessionParameter [-sessTimeout] [-SSO] [-ssoDomain] [-persistentCookie] [-defaultAuthorizationAction] [ssoCredential] [-httpOnlyCookie] [-persistentCookieValidity] Description Unset parameters for the tm session.Refer to the set tm sessionParameter command for meanings of the arguments. Arguments Example
Related Commands set tm sessionParameter show tm sessionParameter
show tm sessionParameter
Synopsis show tm sessionParameter Description Display the configured tm session parameters. Arguments format level name sessTimeout The session timeout, in minutes. defaultAuthorizationAction The Authentication Action, e.g. allow or deny. SSO Whether or not Single Sign-On is used for this session. ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On ssoDomain NT domain to use with SSO
httpOnlyCookie whether the session cookie will be httpOnly or not persistentCookie Whether persistent cookie should be allowed on this TM session persistentCookieValidity Number of minutes for which the persistent cookie would be valid Example
Related Commands set tm sessionParameter unset tm sessionParameter
Chapter
41
Tunnel Commands
Topics: add tunnel trafficPolicy rm tunnel trafficPolicy set tunnel trafficPolicy unset tunnel trafficPolicy show tunnel trafficPolicy bind tunnel global unbind tunnel global show tunnel global
1262 | Citrix NetScaler 10 | Tunnel Commands
add tunnel trafficPolicy

Synopsis add tunnel trafficPolicy <name> <rule> <action> Description Create a tunnel trafficpolicy. Arguments name The name of the new tunnel trafficpolicy. rule The expression specifying the condition under which this policy is applied. action The name of the action to be performed. The string value may be one of the following built-in compression actions: COMPRESS: Enables default compression (DEFLATE). NOCOMPRESS: Disables compression. GZIP: Enables GZIP compression. DEFLATE: Enables DEFLATE compression. Example Example 1: add tunnel trafficpolicy cmp_all_destport "REQ.TCP.DESTPORT == 0-65535" GZIP After creating above tunnel policy, it can be activated by binding it globally: bind tunnel global cmp_all_destport The policy is evaluated for all traffic flowing through the ssl-vpn tunnel, and compresses traffic for all TCP application ports. Example 2: The following tunnel policy disables compression for all access from a specific subnet: add tunnel trafficpolicy local_sub_nocmp "SOURCEIP == 10.1.1.0 -netmask 255.255.255.0" NOCOMPRESS bind tunnel global local_sub_nocmp
Related Commands rm tunnel trafficPolicy set tunnel trafficPolicy unset tunnel trafficPolicy show tunnel trafficPolicy
rm tunnel trafficPolicy
Synopsis rm tunnel trafficPolicy <name> Description Remove a tunnel traffic policy. Arguments name The name of the tunnel traffic policy.
Citrix NetScaler 10 | Tunnel Commands | 1263
Example rm tunnel trafficpolicy tunnel_policy_name The "show tunnel trafficpolicy" command shows all tunnel policies that are currently defined. Related Commands add tunnel trafficPolicy set tunnel trafficPolicy unset tunnel trafficPolicy show tunnel trafficPolicy
set tunnel trafficPolicy

Synopsis set tunnel trafficPolicy <name> [-rule <expression>] [-action <string>] Description Modify the rule and/or action of an existing tunnel traffic policy, created using the "add tunnel trafficpolicy" command. Arguments name The name of the policy to be modified. rule The new rule to be used in the policy. action The new action to be applied by the policy. Example add tunnel trafficpolicy cmp_all_destport "REQ.TCP.DESTPORT == 0-65535" GZIP set tunnel trafficpolicy cmp_all_destport -action NOCOMPRESS Above 'set' command changes action for policy cmp_all_destport from GZIP to NOCOMPRESS Related Commands add tunnel trafficPolicy rm tunnel trafficPolicy unset tunnel trafficPolicy show tunnel trafficPolicy
unset tunnel trafficPolicy

Synopsis unset tunnel trafficPolicy <name> [-rule] [-action] Description Use this command to remove tunnel trafficPolicy settings.Refer to the set tunnel trafficPolicy command for meanings of the arguments.
Arguments Example
Related Commands add tunnel trafficPolicy rm tunnel trafficPolicy set tunnel trafficPolicy show tunnel trafficPolicy
show tunnel trafficPolicy

Synopsis show tunnel trafficPolicy [<name>] Description Display all tunnel policies that are currently defined. Arguments name The name of the tunnel traffic policy. summary fullValues format level rule The expression specifying the condition under which this policy is applied. action The name of the action to be performed. The string value may be one of the following built-in compression actions: COMPRESS: Enables default compression (DEFLATE). NOCOMPRESS: Disables compression. GZIP: Enables GZIP compression. DEFLATE: Enables DEFLATE compression. hits No of hits. txbytes Number of bytes transmitted. rxbytes Number of bytes received. clientTTLB Total client TTLB value. clientTransactions Number of client transactions. serverTTLB Total server TTLB value.
serverTransactions Number of server transactions. boundTo The entity name to which policy is bound activePolicy priority flags bindPolicyType isDefault A value of true is returned if it is a default tunnelpolicy. policyType count stateflag Example > show tunnel trafficpolicy 2 Tunnel policies: 1) Name: local_sub_nocmp Rule: SOURCEIP == 10.1.1.0 -netmask 255.255.255.0 Action: NOCOMPRESS Hits: 3 2) Name: cmp_all Rule: REQ.TCP.DESTPORT == 0-65535 Action: GZIP Hits: 57125 Bytes In:...796160 Bytes Out:... 197730 Bandwidth saving...75.16% Ratio 4.03:1 Done
Related Commands add tunnel trafficPolicy rm tunnel trafficPolicy set tunnel trafficPolicy unset tunnel trafficPolicy
bind tunnel global

Synopsis bind tunnel global (<policyName> [-priority <positive_integer>]) [-state ( ENABLED | DISABLED )] Description Activate the tunnel traffic policy globally. The tunnel policies are created using the "add tunnel trafficpolicy" command. The command "show tunnel trafficpolicy" shows all the existing tunnel policies and the command "show tunnel global" shows all the globally active tunnel policies. Note that the ssl-vpn license is required for tunnel compression feature to work. Arguments policyName The name of the tunnel traffic policy to be bound. Example add tunnel trafficpolicy cmp_all_destport "REQ.TCP.DESTPORT == 0-65535" GZIP After creating above tunnel policy, it can be activated by binding it globally: bind tunnel global
cmp_all_destport After binding cmp_all_destport compression policy globally, the policy gets activated and the NetScaler will compress all TCP traffic accessed through ssl-vpn tunnel. Globally active tunnel policies can be seen using command: > show tunnel global 1 Globally Active Tunnel Policies: 1) Policy Name: cmp_all_destport Priority: 0 Done
Related Commands unbind tunnel global show tunnel global
unbind tunnel global

Synopsis unbind tunnel global <policyName> Description Deactivate an active tunnel traffic policy. Use command "show tunnel global" to see all the globally active tunnel policies. Arguments policyName The name of the tunnel traffic policy. Example Globally active tunnel policies can be seen using command: > show tunnel global 1 Globally Active Tunnel Policies: 1) Policy Name: cmp_all_destport Priority: 0 Done The globally active tunnel traffic policy can be deactivated on the NetScaler system by issuing the command: unbind tunnel global cmp_all_destport
Related Commands bind tunnel global show tunnel global
show tunnel global

Synopsis show tunnel global Description Display global active tunnel policies. Arguments summary fullValues format level
policyName Policy name. priority Priority. state The current state of the binding. count stateflag Example > sh tunnel global 1) Policy Name: cmp_all_destport Priority: 0 2) Policy Name: local_sub_nocmp Priority: 500 Done
Related Commands bind tunnel global unbind tunnel global
Chapter
42
Transform Commands
Topics: add transform profile rm transform profile set transform profile unset transform profile show transform profile add transform action rm transform action set transform action unset transform action show transform action add transform policy rm transform policy set transform policy unset transform policy show transform policy stat transform policy rename transform policy add transform policylabel rm transform policylabel bind transform policylabel unbind transform policylabel show transform policylabel stat transform policylabel rename transform policylabel bind transform global unbind transform global show transform global
1270 | Citrix NetScaler 10 | Transform Commands
add transform profile

Synopsis add transform profile <name> [-type URL] Description Create a URL Transformation profile. Arguments name URL Transformation profile name. type Type of transformation. Possible values: URL Example
Related Commands rm transform profile set transform profile unset transform profile show transform profile
rm transform profile
Synopsis rm transform profile <name> Description Remove a URL Transformation profile. Arguments name URL Transformation profile name. Example
Related Commands add transform profile set transform profile unset transform profile show transform profile
set transform profile

Synopsis set transform profile <name> [-type URL] [-onlyTransformAbsURLinBody ( ON | OFF )] [-comment <string>]
Citrix NetScaler 10 | Transform Commands | 1271
Description Modify URL Transformation action settings. Arguments name URL Transformation action name. type Type of transformation. Possible values: URL onlyTransformAbsURLinBody Flag to only perform transformations of absolute URLs in HTTP body. Possible values: ON, OFF comment Comments. Example
Related Commands add transform profile rm transform profile unset transform profile show transform profile
unset transform profile

Synopsis unset transform profile <name> [-type] [-onlyTransformAbsURLinBody] [-comment] Description Use this command to remove transform profile settings.Refer to the set transform profile command for meanings of the arguments. Arguments Example
Related Commands add transform profile rm transform profile set transform profile show transform profile
show transform profile

Synopsis show transform profile [<name>]
Description Display the configured URL Transformation profiles. Arguments name URL Transformation profile name. summary fullValues format level actionName URL Transformation action name. stateflag type Type of transformation. RegexForFindingURLinJavaScript Patclass having regexes to find the URLs in JavaScript. RegexForFindingURLinCSS Patclass having regexes to find the URLs in CSS. RegexForFindingURLinXComponent Patclass having regexes to find the URLs in X-Component. RegexForFindingURLinXML Patclass having regexes to find the URLs in XML. additionalReqHeadersList Patclass having a list of additional request header names that should transformed. additionalRespHeadersList Patclass having a list of additional response header names that should transformed. onlyTransformAbsURLinBody Flag to only perform transformations of absolute URLs in HTTP body. comment Comments. priority Priority of the Action within the Profile. state Enabled flag. profileName URL Transformation profile name. reqUrlFrom Pattern of original request URLs. It corresponds to the way external users view the server, and acts as a source for request transformations. reqUrlInto Pattern of transformed request URLs. It corresponds to internal addresses and indicates how they are created.
resUrlFrom Pattern of original response URLs. It corresponds to the way external users view the server, and acts as a source for response transformations. resUrlInto Pattern of transformed response URLs. It corresponds to internal addresses and indicates how they are created. cookieDomainFrom Pattern of the original domain in Set-Cookie headers. cookieDomainInto Pattern of the transformed domain in Set-Cookie headers. actionComment Comments. count Example
Related Commands add transform profile rm transform profile set transform profile unset transform profile
add transform action

Synopsis add transform action <name> <profileName> <priority> Description Create a URL Transformation action. Arguments name URL Transformation action name. profileName URL Transformation profile name. priority Priority of the Action within the Profile. Minimum value: 1 Maximum value: 2147483647 Example
Related Commands rm transform action set transform action unset transform action
show transform action
rm transform action
Synopsis rm transform action <name> Description Remove a URL Transformation action. Arguments name URL Transformation action name. Example
Related Commands add transform action set transform action unset transform action show transform action
set transform action

Synopsis set transform action <name> [-priority <positive_integer>] [-reqUrlFrom <expression>] [-reqUrlInto <expression>] [-resUrlFrom <expression>] [-resUrlInto <expression>] [-cookieDomainFrom <expression>] [-cookieDomainInto <expression>] [-state ( ENABLED | DISABLED )] [-comment <string>] Description Modify URL Transformation action settings. Arguments name URL Transformation action name. priority Priority of the Action within the Profile. Minimum value: 1 Maximum value: 2147483647 reqUrlFrom Pattern of original request URLs. It corresponds to the way external users view the server, and acts as a source for request transformations. reqUrlInto Pattern of transformed request URLs. It corresponds to internal addresses and indicates how they are created. resUrlFrom Pattern of original response URLs. It corresponds to the way external users view the server, and acts as a source for response transformations.
resUrlInto Pattern of transformed response URLs. It corresponds to internal addresses and indicates how they are created. cookieDomainFrom Pattern of the original domain in Set-Cookie headers. cookieDomainInto Pattern of the transformed domain in Set-Cookie headers. state Enabled flag. Possible values: ENABLED, DISABLED comment Comments. Example
Related Commands add transform action rm transform action unset transform action show transform action
unset transform action

Synopsis unset transform action <name> [-priority] [-reqUrlFrom] [-reqUrlInto] [-resUrlFrom] [-resUrlInto] [cookieDomainFrom] [-cookieDomainInto] [-state] [-comment] Description Use this command to remove transform action settings.Refer to the set transform action command for meanings of the arguments. Arguments Example
Related Commands add transform action rm transform action set transform action show transform action
show transform action

Synopsis show transform action [<name>]
Description Display the configured URL Transformation action. Arguments name URL Transformation profile name. summary fullValues format level stateflag profileName URL Transformation profile name. priority Priority of the Action within the Profile. reqUrlFrom Pattern of original request URLs. It corresponds to the way external users view the server, and acts as a source for request transformations. reqUrlInto Pattern of transformed request URLs. It corresponds to internal addresses and indicates how they are created. resUrlFrom Pattern of original response URLs. It corresponds to the way external users view the server, and acts as a source for response transformations. resUrlInto Pattern of transformed response URLs. It corresponds to internal addresses and indicates how they are created. cookieDomainFrom Pattern of the original domain in Set-Cookie headers. cookieDomainInto Pattern of the transformed domain in Set-Cookie headers. continueMatching Continue transforming using the next rule in the list. state Enabled flag. comment Comments. count Example
Related Commands add transform action
rm transform action set transform action unset transform action
add transform policy

Synopsis add transform policy <name> <rule> <profileName> [-comment <string>] [-logAction <string>] Description Create a URL Transformation policy. Arguments name URL Transformation policy name. rule The rule associated with the policy. profileName URL Transformation profile name. comment Comments associated with this transform policy. logAction The log action associated with the transform policy Example
Related Commands rm transform policy set transform policy unset transform policy show transform policy stat transform policy rename transform policy
rm transform policy
Synopsis rm transform policy <name> Description Remove a URL Transformation policy. Arguments name
URL Transformation policy name. Example rm transform policy trans_pol
Related Commands add transform policy set transform policy unset transform policy show transform policy stat transform policy rename transform policy
set transform policy

Synopsis set transform policy <name> [-rule <expression>] [-profileName <string>] [-comment <string>] [-logAction <string>] Description Set a new rule/profile/comment for existing transform policy. Arguments name URL Transformation policy name. rule The rule associated with the policy. profileName URL Transformation profile name. comment Comments associated with this transform policy. logAction The log action associated with the transform policy Example set transform policy pol9 -rule "HTTP.REQ.HEADER(\\"header\\").CONTAINS(\\"qh2\\")"
Related Commands add transform policy rm transform policy unset transform policy show transform policy stat transform policy
rename transform policy
unset transform policy

Synopsis unset transform policy <name> [-comment] [-logAction] Description Unset comment/logaction for existing transform policy..Refer to the set transform policy command for meanings of the arguments. Arguments Example unset transform policy pol9 -undefAction
Related Commands add transform policy rm transform policy set transform policy show transform policy stat transform policy rename transform policy
show transform policy

Synopsis show transform policy [<name>] Description Display the Url Transform policies. Arguments name URL Transformation policy name. summary fullValues format level stateflag rule The rule associated with the policy. profileName URL Transformation profile name.
priority Specifies the priority of the policy. hits Number of hits. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. comment Comments associated with this transform policy. logAction The log action associated with the transform policy bindPolicyType vserverType count Example
Related Commands add transform policy rm transform policy set transform policy unset transform policy stat transform policy rename transform policy
stat transform policy

Synopsis stat transform policy [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display transform policy statistics. Arguments name
The name of the transform policy for which statistics will be displayed. If not given statistics are shown for all transform policies. count devno stateflag Policy hits (Hits) Number of hits on the policy Policy undef hits (Undefhits) Number of undef hits on the policy Example stat transform policy
Related Commands add transform policy rm transform policy set transform policy unset transform policy show transform policy rename transform policy stat transform policylabel
rename transform policy

Synopsis rename transform policy <name>@ <newName>@ Description Rename a transform policy. Arguments name The name of the transform policy. newName The new name of the transform policy. Example rename transform policy oldname newname
Related Commands add transform policy rm transform policy set transform policy
unset transform policy show transform policy stat transform policy
add transform policylabel

Synopsis add transform policylabel <labelName> <policylabeltype> Description Add a transform policy label. Arguments labelName Name of the transform policy label. policylabeltype The type of transformations allowed by the policies bound to the label. Possible values: http_req Example add transform policylabel trans_policylabel http_req Related Commands rm transform policylabel bind transform policylabel unbind transform policylabel show transform policylabel stat transform policylabel rename transform policylabel
rm transform policylabel
Synopsis rm transform policylabel <labelName> Description Remove a transform policy label. Arguments labelName Name of the transform policy label. Example rm transform policylabel trans_policylabel Related Commands add transform policylabel
bind transform policylabel unbind transform policylabel show transform policylabel stat transform policylabel rename transform policylabel
bind transform policylabel

Synopsis bind transform policylabel <labelName> <policyName> <priority> [<gotoPriorityExpression>] [-invoke (<labelType> <labelName>) ] Description Bind the transform policy to one of the labels. Arguments labelName Name of the transform policy label. policyName The transform policy name. Example i) bind transform policylabel trans_policylabel pol_1 1 2 -invoke reqvserver CURRENT ii) bind transform policylabel trans_policylabel pol_2 2
Related Commands add transform policylabel rm transform policylabel unbind transform policylabel show transform policylabel stat transform policylabel rename transform policylabel
unbind transform policylabel

Synopsis unbind transform policylabel <labelName> <policyName> [-priority <positive_integer>] Description Unbind entities from transform label. Arguments labelName Name of the transform policy label. policyName
The transform policy name. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind transform policylabel trans_policylabel pol_1
Related Commands add transform policylabel rm transform policylabel bind transform policylabel show transform policylabel stat transform policylabel rename transform policylabel
show transform policylabel

Synopsis show transform policylabel [<labelName>] Description Display policy label or policies bound to transform policylabel. Arguments labelName Name of the transform policy label. summary fullValues format level stateflag policylabeltype The type of transformations allowed by the policies bound to the label. numpol Number of polices bound to label. hits Number of times policy label was invoked. policyName The transform policy name. priority Specifies the priority of the policy. gotoPriorityExpression
Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. description Description of the policylabel flags count Example i) show transform policylabel trans_policylabel ii) show transform policylabel
Related Commands add transform policylabel rm transform policylabel bind transform policylabel unbind transform policylabel stat transform policylabel rename transform policylabel
stat transform policylabel

Synopsis stat transform policylabel [<labelName>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display statistics of transform policylabel(s). Arguments labelName The name of the transform policy label for which statistics will be displayed. If not given statistics are shown for all transform policylabels. count devno stateflag Policy Label Hits (Hits) Number of times policy label was invoked. Example
Related Commands add transform policylabel rm transform policylabel bind transform policylabel unbind transform policylabel show transform policylabel rename transform policylabel stat transform policy
rename transform policylabel

Synopsis rename transform policylabel <labelName>@ <newName>@ Description Rename a transform policy label. Arguments labelName The name of the transform policylabel. newName The new name of the transform policylabel. Example rename transform policylabel oldname newname Related Commands add transform policylabel rm transform policylabel bind transform policylabel unbind transform policylabel show transform policylabel stat transform policylabel
bind transform global

Synopsis bind transform global <policyName> <priority> [<gotoPriorityExpression>] [-type ( REQ_OVERRIDE | REQ_DEFAULT )] [-invoke (<labelType> <labelName>) ] Description Bind the Url Transform policy globally Arguments policyName
Name of the policy to be bound to URL transform global. Example bind transform global pol9 9
Related Commands unbind transform global show transform global
unbind transform global

Synopsis unbind transform global <policyName> [-type ( REQ_OVERRIDE | REQ_DEFAULT )] [-priority <positive_integer>] Description Unbind globally bound Url Transform policy. Arguments policyName The name of the policy to be unbound. priority Priority of the NOPOLICY to be unbound. Minimum value: 1 Maximum value: 2147483647 Example unbind transform global pol9
Related Commands bind transform global show transform global
show transform global

Synopsis show transform global [-type ( REQ_OVERRIDE | REQ_DEFAULT )] Description Display the transform global bindings. Arguments type The bindpoint to which policy is bound. Possible values: REQ_OVERRIDE, REQ_DEFAULT summary fullValues
format level stateflag policyName Name of the transform policy. priority Specifies the priority of the policy. gotoPriorityExpression Expression specifying the priority of the next policy which will get evaluated if the current policy rule evaluates to TRUE. labelType Type of policy label invocation. labelName Name of the label to invoke if the current policy rule evaluates to TRUE. flowType flowtype of the bound transform policy. numpol The number of policies bound to the bindpoint. flags count Example show transform global
Related Commands bind transform global unbind transform global
Chapter
43
Utility Commands
Topics: nstrace scp shell install grep traceroute6 traceroute ping6 ping show techsupport config audit show callhome set callhome unset callhome
1290 | Citrix NetScaler 10 | Utility Commands
nstrace
Synopsis nstrace [-nf <positive_integer>] [-time <secs>] [-size <positive_integer>] [-mode <mode> ...] [-tcpdump ( ENABLED | DISABLED ) [-perNIC ( ENABLED | DISABLED )]] [-name <string> [-id <string>]] [-filter <expression> [-link ( ENABLED | DISABLED )]] Description Invoke nstrace program to log traffic flowing through netscaler Arguments h prints this message - exclusive option nf number of files to be generated in cycle Default value: 24 time Log in each trace file for 'time' seconds. (could be an expression) Default value: 3600 size size of the packet to be logged(should be in the range of 60 to 1514 bytes). Setting size as zero, logs full packet. Default value: 164 Maximum value: 1514 m Capturing mode: sum of the values: 1 - Transmitted packets (TX) 2 - Packets buffered for transmission (TXB) 4 - Received packets (RX) Default value: 6 tcpDump nstrace-format, tcpdump-format Possible values: NSTRACE, TCPDUMP mode Capturing mode for trace. Mode can be any of the following values or combination of these values: RX Received packets before NIC pipelining NEW_RX Received packets after NIC pipelining TX Transmitted packets TXB Packets buffered for transmission IPV6 Translated IPv6 packets Default mode: NEW_RX TXB Default value: DEFAULT_MODE tcpdump Log files format supported:nstrace-format, tcpdump-format. default:nstrace-format Possible values: ENABLED, DISABLED Default value: DISABLED name Custom file name for nstrace files filter Filter expression for nstrace. Maximum length of filter is 255 and it can be of following format: <expression> [<relop> <expression>] <relop> = ( && | || ) <expression> = the expression string in the format: <qualifier> <operator> <qualifier-value> <qualifier> = SOURCEIP. <qualifiervalue> = A valid IP address <qualifier> = SOURCEPORT. <qualifier-value> = A valid port number. <qualifier> = DESTIP. <qualifier-value> = A valid IP address. <qualifier> = DESTPORT. <qualifier-value> = A valid port number. <qualifier> = IP. <qualifier-value> = A valid IP address. <qualifier> = PORT. <qualifier-value> = A valid port number. <qualifier> = SVCNAME. <qualifier-value> = The name of a service. <qualifier> = VSVRNAME. <qualifier-value> = The name of a vserver. <qualifier> = CONNID <qualifier-value> = A valid PCB dev number. <qualifier> = VLAN <qualifier-value> = A valid VLAN ID. <qualifier> = INTF <qualifier-value> = A valid interface id in the form of x/y. <operator> = ( == | eq | != | neq | > | gt | < | lt | >= | ge |
Citrix NetScaler 10 | Utility Commands | 1291
<= | le | BETWEEN ) eg: nstrace.sh -filter SOURCEIP == 10.102.34.201 || (SVCNAME != s1 && SOURCEPORT > 80) Filter expression should be given in doble quotes. Example nstrace -nf 10 -time 100 -mode RX IPV6 TXB -name abc -tcpdump ENABLED -perNIC ENABLED
Related Commands
scp
Synopsis scp [-r] [-C] [-q] <sourceString> <destString> Description Securely copy data from one computer to another via the ssh protocol. Arguments r Recursively copy subdirectories C Enable compression q Quiet output - disable progress meter sourceString The source user, host and file path, specified as user@host:path/to/copy/from. User and host parts are optional. destString The destination user, host and file path, specified as user@host:path/to/copy/to. User and host parts are optional. Example scp /nsconfig/ns.conf nsroot@10.102.4.107:/nsconfig/
Related Commands
shell
Synopsis shell [(command)] Description Exit to the FreeBSD command prompt, where FreeBSD commands may be entered. Press the <Control> + <D> keys or type exit to return to the NetScaler system CLI prompt. Arguments command
The shell command(s) to be invoked. Example > shell # ps | grep nscli 485 p0 S 0:01.12 -nscli (nscli) 590 p0 S+ 0:00.00 grep nscli # ^D Done > shell ps -aux |grep nscli 485 p0 S 0:01.12 -nscli (nscli) 590 p0 S+ 0:00.00 grep nscli
Related Commands
install
Synopsis install <url> [-c] [-y] Description Install a version of NetScaler software on the system. The command takes a single argument consisting of a valid URL for the HTTP, HTTPS, FTP, and SFTP protocols. Local files may be specified using the file:// URL variation. http://[user]:[password]@host/path/to/file https://[user]:[password]@host/path/to/file sftp://[user]:[password]@host/ path/to/file scp://[user]:[password]@host/path/to/file ftp://[user]:[password]@host/path/to/file file://path/to/file Arguments url http://[user]:[password]@host/path/to/file https://[user]:[password]@host/path/to/file sftp:// [user]:[password]@host/path/to/file scp://[user]:[password]@host/path/to/file ftp://[user]: [password]@host/path/to/file file://path/to/file c Specifiy this option to backup existing kernel. y Specify this option to avoid prompt for yes/no i.e. reboot. Example install http://host.netscaler.com/ns-6.0-41.2.tgz
Related Commands
grep
Synopsis grep [-c] [-E] [-i] [-v] [-w] [-x] <pattern> Description grep to search files or output for lines containing a match to the given <pattern>. By default, grep prints the matching lines. Arguments c Suppress normal output; instead print a count of matching lines. With the -v option, count nonmatching lines.
E Interpret <pattern> as an extended regular expression. i Ignore case distinctions. v Invert the sense of matching, to select non-matching lines. w Select only those lines containing matches that form whole words. x Select only those matches that exactly match the whole line. pattern The pattern (regular expression or text string) being sought. Example show ns info | grep off -i
Related Commands
traceroute6
Synopsis traceroute6 [-n] [I] [-r] [-v] [-m <hoplimit>] [-p <port>] [-q <probes>] [-s <src_addr>] [-w <waittime>] <target> [<packetlen>] Description Invoke the UNIX traceroute6 command. Traceroute6 attempts to track the route that the packets follow to reach the destination host. Arguments n Print hop addresses numerically rather than symbolically and numerically. I Use ICMP ECHO for probes r Bypass the normal routing tables and send directly to a host on an attached network. If the host is not on a directly-attached network, an error is returned. v Verbose output. Received ICMP packets other than TIME_EXCEEDED and UNREACHABLEs are listed. m The maximum hop value used in outgoing probe packets. Default value: 64 Minimum value: 1 Maximum value: 255 p The base port number used in probes. Default value: 33434 Minimum value: 1 Maximum value: 65535
q The number of probe per hop. Default value: 3 Minimum value: 1 Maximum value: 65535 s The source IP address to be used in the outgoing query packets. If the IP address is not one of this machine's addresses, an error is returned and nothing is sent. w The time (in seconds) to wait for a response to a query. Default value: 5 Minimum value: 2 Maximum value: 86399 host The destination host ip address or name. packetlen The packet length (in bytes) of the query packets. Default value: 44 Minimum value: 44 Maximum value: 32768 Example traceroute6 2002::7
Related Commands
traceroute
Synopsis traceroute [-S] [-n] [-r] [-v] [-M <min_ttl] [-m <max_ttl>] [-P <protocol>][-p <portno>] [-q <nqueries>] [-s <src_addr>] [-t <tos>] [-w <wait>] <host> [<packetlen>] Description Invoke the UNIX traceroute command. Traceroute attempts to track the route that the packets follow to reach the destination host. Arguments S Print a summary of how many probes were not answered for each hop. n Print hop addresses numerically rather than symbolically and numerically. r Bypass the normal routing tables and send directly to a host on an attached network. If the host is not on a directly-attached network, an error is returned. v Verbose output. Received ICMP packets other than TIME_EXCEEDED and UNREACHABLEs are listed. M The minimum ttl value used in outgoing probe packets. Default value: 1 Minimum value: 1 Maximum value: 255 m The maximum TTL value used in outgoing probe packets. Default value: 64 Minimum value: 1 Maximum value: 255
P Send packets of specified IP protocol. The currently supported protocols are UDP and ICMP. p The base port number used in probes. Default value: 33434 Minimum value: 1 Maximum value: 65535 q The number of queries per hop. Default value: 3 Minimum value: 1 Maximum value: 65535 s The source IP address to be used in the outgoing query packets. If the IP address is not one of this machine's addresses, an error is returned and nothing is sent. t The type-of-service in query packets. Maximum value: 255 w The time (in seconds) to wait for a response to a query. Default value: 5 Minimum value: 2 Maximum value: 86399 host The destination host ip address or name. packetlen The packet length (in bytes) of the query packets. Default value: 44 Minimum value: 44 Maximum value: 32768 Example traceroute 10.102.4.107
Related Commands
ping6
Synopsis ping6 [-c <count>] [-i <interval>] [-I <interface>] [-n] [-p <pattern>] [-q] [-S sourceaddr] [-V <vlanid>] [-s <size>] Hostname Description Invoke the UNIX ping6 command. The <hostName> option is used if the name is in /etc/hosts file directory or is otherwise known in DNS. Arguments c Number of packets to send (default is infinite) Minimum value: 1 Maximum value: 65535 i Waiting time in seconds (default is 1 sec) Maximum value: 65535 I Network interface on which to ping6, if you have multiple interfaces n Numeric output only - no name resolution
p Pattern to fill in packets. Can be up to 16 bytes, useful for diagnosing data-dependent problems. q Quiet output - only summary is printed s Data size in bytes (default is 56) Maximum value: 65507 V VLAN ID for link local address Minimum value: 1 Maximum value: 4094 S The source IP address to be used in the outgoing query packets. t Timeout in seconds before ping6 exits hostName Address of host to ping6 Example ping6 -p ff -I 1/1 -c 4 2002::1
Related Commands
ping
Synopsis ping [-c <count>] [-i <interval>] [-I <interface>] [-n] [-p <pattern>] [-q] [-s <size>] [-S <src_addr>] [-t <timeout>] <hostname> Description Invoke the UNIX ping command. The <hostName> option is used if the name is in /etc/hosts file directory or is otherwise known in DNS. Arguments c Number of packets to send (default is infinite) Minimum value: 1 Maximum value: 65535 i Waiting time in seconds (default is 1 sec) Maximum value: 65535 I Network interface on which to ping, if you have multiple interfaces n Numeric output only - no name resolution p Pattern to fill in packets. Can be up to 16 bytes, useful for diagnosing data-dependent problems. q Quiet output - only summary is printed s
Data size in bytes (default is 56) Maximum value: 65507 S The source IP address to be used in the outgoing query packets. If the IP addrESS Is not one of this machine's addresses, an error is returned and nothing is sent. t Timeout in seconds before ping exits Minimum value: 1 Maximum value: 3600 hostName Address of host to ping Example ping -p ff -c 4 10.102.4.107
Related Commands
show techsupport
Synopsis show techsupport [-scope ( NODE | CLUSTER )] Description This command generates a tar archive of system configuration data and statistics for submission to Citrix ANG technical support with file name collector_<NS IP>_<P/S>_<DateTime>.tgz. The archive is always pointed by the symbolic link /var/tmp/support/support.tgz for each invocation of the command. Arguments scope Use this option to run showtechsupport on present node or all cluster nodes. Possible values: NODE, CLUSTER Default value: NS_TECH_NODE serverName Example show techsupport
Related Commands
config audit
Synopsis
Description audit and verify the commands in file against running config. NOTE: This command is deprecated.Command deprecated. Use diff ns config command Arguments commandStr
specify the options. Example config audit -diff -f <filename>
Related Commands
show callhome
Synopsis show callhome Description Displays the trigger events configured and the time when these events were triggered. Arguments format level emailAddress The contact person's E-mail address. sslcardfirstfailure First occurrence SSL card failure. sslcardlatestfailure Latest occurrence SSL card failure. powfirstfail First occurrence power supply unit failure. powlatestfailure Latest occurrence power supply unit failure. HDDfirstfail First occurrence hard disk drive failure. HDDlatestfailure Latest occurrence hard disk drive failure. FLASHfirstfail First occurrence compact flash failure. FLASHlatestfailure Latest occurrence compact flush failure. restartLatestfail Latest occurrence warm restart failure. callhomestatus Callhome feature enabled/disable, register with upload server successful/failed Example show callhome E-mail address configured:xxx@yahoo.com Trigger event State First occurrence Latest occurrence ------------- ----- ---------------- ----------------- 1) Compact flash errors
Enabled .. .. 2) Hard disk drive errors Enabled .. .. 3) Power supply unit failure Enabled 27 Aug 2010 18:22:47 28 Aug 2010 18:22:47 4) SSL card failure Enabled 25 Aug 2010 18:22:47 26 Aug 2010 18:22:47 5) Warm restart Enabled N/A ..
Related Commands set callhome unset callhome
set callhome
Synopsis set callhome -emailAddress e-mailaddress Description Sets the contact person's E-mail address Arguments emailAddress The contact person's E-mail address Example set callhome -emailAddress xxxx@yahoo.com
Related Commands show callhome unset callhome
unset callhome
Synopsis unset callhome -emailAddress Description Use this command to remove callhome settings.Refer to the set callhome command for meanings of the arguments. Arguments Example
Related Commands show callhome set callhome
Chapter
44
Vpn Commands
Topics: stat vpn add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver bind vpn vserver unbind vpn vserver enable vpn vserver disable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver add vpn intranetApplication rm vpn intranetApplication show vpn intranetApplication add vpn nextHopServer rm vpn nextHopServer show vpn nextHopServer add vpn trafficPolicy rm vpn trafficPolicy set vpn trafficPolicy unset vpn trafficPolicy show vpn trafficPolicy add vpn trafficAction rm vpn trafficAction set vpn trafficAction unset vpn trafficAction show vpn trafficAction add vpn formSSOAction rm vpn formSSOAction set vpn formSSOAction unset vpn formSSOAction show vpn formSSOAction add vpn url rm vpn url set vpn url
1302 | Citrix NetScaler 10 | Vpn Commands
unset vpn url show vpn url add vpn sessionPolicy rm vpn sessionPolicy set vpn sessionPolicy unset vpn sessionPolicy show vpn sessionPolicy add vpn sessionAction rm vpn sessionAction set vpn sessionAction unset vpn sessionAction show vpn sessionAction add vpn clientlessAccessPolicy rm vpn clientlessAccessPolicy set vpn clientlessAccessPolicy show vpn clientlessAccessPolicy add vpn clientlessAccessProfile rm vpn clientlessAccessProfile set vpn clientlessAccessProfile unset vpn clientlessAccessProfile show vpn clientlessAccessProfile show vpn stats show vpn icaConnection bind vpn global unbind vpn global show vpn global set vpn parameter unset vpn parameter show vpn parameter
Citrix NetScaler 10 | Vpn Commands | 1303
stat vpn
Synopsis stat vpn [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display VPN statistics. Arguments Login-page requests received (iHtHit) Number of requests for VPN login page. Login-page delivery failures (iHtFail) Number of failures to display VPN login page. Client-configuration requests (cfgHit) Number of client configuration requests received by VPN server. DNS queries resolved (dnsHit) Number of DNS queries resolved by VPN server. WINS queries resolved (winsHit) Number of WINS queries resolved by VPN server. Number of SSLVPN tunnels (csHit) Number of SSL VPN tunnels formed between VPN server and client. Backend non-HTTP server probes (csNoHttp) Number of probes from VPN to back-end non-HTTP servers that have been accessed by the VPN client. Backend HTTP server probes (csHttp) Number of probes from VPN to back-end HTTP servers that have been accessed by the VPN client. Backend server probe successes (csConSuc) Number of successful probes to all back-end servers. File-system requests received (totFsHit) Number of file system requests received by VPN server. IIP disabled and MIP used (IIPdMIPu) Number of times MIP is used as IIP is disabled. IIP failed and MIP used (IIPfMIPu) Number of times MIP is used as IIP assignment failed. IIP spillover and MIP used (IIPsMIPu) Number of times MIP is used on IIP Spillover. IIP disabled and MIP disabled (IIPdMIPd) Both IIP and MIP is disabled. IIP failed and MIP disabled (IIPfMIPd) Number of times IIP assignment failed and MIP is disabled. SOCKS method request received (SOCKSmReqR) Number of received SOCKS method request. SOCKS method request sent (SOCKSmReqS)
Number of sent SOCKS method request. SOCKS method response received (SOCKSmRespR) Number of received SOCKS method response. SOCKS method response sent (SOCKSmRespS) Number of sent SOCKS method response. SOCKS connect request received (SOCKScReqR) Number of received SOCKS connect request. SOCKS connect request sent (SOCKScReqS) Number of sent SOCKS connect request. SOCKS connect response received (SOCKScRespR) Number of received SOCKS connect response. SOCKS connect response sent (SOCKScRespS) Number of sent SOCKS connect response. SOCKS server error (SOCKSserverErr) Number of SOCKS server error. SOCKS client error (SOCKSclientErr) Number of SOCKS client error. STA connection success (STAconnSucc) Number of STA connection success. STA connection failure (STAconnFail) Number of STA connection failure. CPS connection success (CPSconnSucc) Number of CPS connection success. CPS connection failure (CPSconnFail) Number of CPS connection failure. STA request sent (STAreqSent) Number of STA request sent. STA response received (STArespRecvd) Number of STA response received. ICA license failure (ICAlicenseFail) Number of ICA license failure. Example
Related Commands stat vpn vserver
add vpn vserver

Synopsis add vpn vserver <name> <serviceType> (<IPAddress> [-range <positive_integer>]) <port> [-state ( ENABLED | DISABLED )] [-authentication ( ON | OFF )] [-doubleHop ( ENABLED | DISABLED )] [-maxAAAUsers <positive_integer>] [-icaOnly ( ON | OFF )] [-downStateFlush ( ENABLED | DISABLED )] [-Listenpolicy
<expression> [-Listenpriority <positive_integer>]] [-tcpProfileName <string>] [-httpProfileName <string>] [comment <string>] [-appflowLog ( ENABLED | DISABLED )] [-icmpVsrResponse ( PASSIVE | ACTIVE )] Description Add a VPN virtual server. Arguments name The name for the new vpn vserver. serviceType The vpn vserver's protocol type, e.g. SSL Possible values: SSL Default value: NSSVC_SSL IPAddress The IP address for the vpn vserver. port The TCP port on which the vserver listens. Minimum value: 1 state The intital vserver server state, e.g. ENABLED or DISABLED Possible values: ENABLED, DISABLED Default value: ENABLED authentication This option toggles on or off the application of authentication of incoming users to the VPN. Possible values: ON, OFF Default value: ON doubleHop This option toggles on or off the application of authentication of incoming users to the VPN. Possible values: ENABLED, DISABLED Default value: DISABLED maxAAAUsers The maximum number of concurrent users allowed to login into this vserver at a time. The administrator can configure any number between 0 and 65535 for this virtual server, but the actual number of users allowed to login into this virtual server will also depend on the total number of user licenses and the total number of currently logged in users. Maximum value: 65535 icaOnly This option tells whether ica only license feature is on or off. Possible values: ON, OFF Default value: OFF downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED Listenpolicy Use this parameter to specify the listen policy for VPN Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of VPN Vserver. Default value: 101 Maximum value: 100 tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment
Comments associated with this virtual server. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example The following example creates a VPN vserver named myvpnvip which supports SSL portocol and with AAA functionality enabled: vserver myvpnvip SSL 65.219.17.34 443 -aaa ON Related Commands rm vpn vserver set vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver
rm vpn vserver
Synopsis rm vpn vserver <name>@ ... Description Remove a virtual server. Arguments name The name of the virtual server to be removed. Example rm vserver vpn_vip Related Commands add vpn vserver set vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver show vpn vserver
stat vpn vserver rename vpn vserver
set vpn vserver

Synopsis set vpn vserver <name> [-IPAddress <ip_addr|ipv6_addr|*>] [-authentication ( ON | OFF )] [-doubleHop ( ENABLED | DISABLED )] [-icaOnly ( ON | OFF )] [-maxAAAUsers <positive_integer>] [-downStateFlush ( ENABLED | DISABLED )] [-Listenpolicy <expression>] [-Listenpriority <positive_integer>] [-tcpProfileName <string>] [-httpProfileName <string>] [-comment <string>] [-appflowLog ( ENABLED | DISABLED )] [icmpVsrResponse ( PASSIVE | ACTIVE )] Description Change the parameters of a VPN virtual server. Arguments name The name of the vserver to be modified. IPAddress The new IP address of the virtual server. authentication Indicates whether or not authentication is being applied to incoming users to the VPN. Possible values: ON, OFF Default value: ON doubleHop Indicates whether double hop functionality is enabled or not. Possible values: ENABLED, DISABLED Default value: DISABLED icaOnly Indicates whether ica only feature is enabled or not Possible values: ON, OFF Default value: OFF maxAAAUsers The maximum number of concurrent users allowed to login into this vserver at a time. The administrator can configure any number between 0 and 65535 for this virtual server, but the actual number of users allowed to login into this virtual server will also depend on the total number of user licenses and the total number of currently logged in users. Maximum value: 65535 downStateFlush Perform delayed clean up of connections on this vserver. Possible values: ENABLED, DISABLED Default value: ENABLED Listenpolicy Use this parameter to specify the listen policy for VPN Vserver. The string can be either an existing expression name (configured using add policy expression command) or else it can be an in-line expression with a maximum of 1500 characters. Default value: "none" Listenpriority Use this parameter to specify the priority for listen policy of VPN Vserver. Default value: 101 Maximum value: 100 tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. comment
Comments associated with this virtual server. appflowLog Enable logging appflow flow information Possible values: ENABLED, DISABLED Default value: ENABLED icmpVsrResponse Can be active or passive Possible values: PASSIVE, ACTIVE Default value: NS_VSR_PASSIVE Example
Related Commands add vpn vserver rm vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver
unset vpn vserver

Synopsis unset vpn vserver <name> [-authentication] [-doubleHop] [-icaOnly] [-maxAAAUsers] [-downStateFlush] [-Listenpolicy] [-Listenpriority] [-tcpProfileName] [-httpProfileName] [-comment] [-appflowLog] [icmpVsrResponse] Description Use this command to remove vpn vserver settings.Refer to the set vpn vserver command for meanings of the arguments. Arguments Example
Related Commands add vpn vserver rm vpn vserver set vpn vserver enable vpn vserver disable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver
bind vpn vserver

Synopsis bind vpn vserver <name> [-policy <string> [-priority <positive_integer>] [-secondary] [-gotoPriorityExpression <expression>] [-type ( REQUEST | RESPONSE )]] [-intranetApplication <string>] [-nextHopServer <string>] [urlName <string>] [-intranetIP <ip_addr> <netmask>] [-staServer <URL>] Description Bind attributes to a vserver. Arguments name The vserver to which this command shall bind parameters. policy The name of the policy to be bound to the vserver. intranetApplication The name of the intranet application to be bound to the vserver. nextHopServer The name of the next hop server to be bound to the vserver. urlName The name of the vpn url to be bound. intranetIP The network id for the range of intranet IP addresses or individual intranet ip to be bound to the vserver. staServer Secure Ticketing Authority (STA) server, in the format 'http(s)://IP/FQDN/URLPATH' Example Related Commands unbind vpn vserver
unbind vpn vserver

Synopsis unbind vpn vserver <name> [-policy <string> [-secondary] [-type ( REQUEST | RESPONSE )]] [intranetApplication <string>] [-nextHopServer <string>] [-urlName <string>] [-intranetIP <ip_addr> <netmask>] [staServer <URL>] Description Unbind attributes from a vserver. Arguments name The name of the vserver from which an attribute is to be unbound. policy The name of the policy to be unbound. intranetApplication The intranet application to be unbound. nextHopServer
The name of the next hop server to be unbound. urlName The vpn url to be unbound. intranetIP The network id for the range of intranet IP addresses or the individually bound intranet IP address to be unbound. staServer Secure Ticketing Authority (STA) server to be removed, in the format 'http(s)://IP/FQDN/ URLPATH' Example Related Commands bind vpn vserver
enable vpn vserver

Synopsis enable vpn vserver <name>@ Description Enable a virtual vpn server. Note: Virtual servers, when added, are enabled by default. Arguments name The name of the virtual server to be enabled. Example enable vserver vpn1 Related Commands add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver disable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver
disable vpn vserver

Synopsis disable vpn vserver <name>@ Description Disable (take out of service) a virtual server. Arguments name
The name of the virtual server to be disabled. Notes: 1. The system still responds to ARP and/or ping requests for the IP address of this virtual server. 2. As the virtual server is still configured in the system, you can enable the virtual server using ###enable vserver### command. Example disable vserver lb_vip Related Commands add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver enable vpn vserver show vpn vserver stat vpn vserver rename vpn vserver
show vpn vserver

Synopsis show vpn vserver [<name>] show vpn vserver stats - alias for 'stat vpn vserver' Description Display all of the configured VPN virtual servers. Arguments name The name of the VPN vserver. summary fullValues format level IPAddress The Virtual IP address of the VPN vserver. IPAddress The IP address of the virtual server. value Indicates whether or not the certificate is bound or if SSL offload is disabled. port The virtual TCP port of the VPN vserver. range The range of vpn vserver IP addresses. The new range of vpn vservers will have IP addresses consecutively numbered, starting with the primary address specified with the <ipaddress> argument. serviceType The vpn vserver's protocol type, Currently the only possible value is SSL.
type The type of Virtual Server, e.g. CONTENT based or ADDRESS based. state The current state of the Virtual server, e.g. UP, DOWN, BUSY, etc. status Whether or not this vserver responds to ARPs and whether or not round-robin selection is temporarily in effect. cacheType Virtual server's cache type. The options are: TRANSPARENT, REVERSE and FORWARD. redirect The cache redirect policy. The valid redirect policies are: l. CACHE - Directs all requests to the cache. 2. POLICY - Applies cache redirection policy to determine whether the request should be directed to the cache or origin. This is the default setting. 3. ORIGIN - Directs all requests to the origin server. precedence This argument is used only when configuring content switching on the specified virtual server. This is applicable only if both the URL and RULE-based policies have been configured on the same virtual server. It specifies the type of policy (URL or RULE) that takes precedence on the content switching virtual server. The default setting is RULE. l URL - In this case, the incoming request is matched against the URL-based policies before the rule-based policies. l RULE - In this case, the incoming request is matched against the rule-based policies before the URL-based policies. For all URL-based policies, the precedence hierarchy is: 1. Domain and exact URL 2. Domain, prefix and suffix 3. Domain and suffix 4. Domain and prefix 5. Domain only 6. Exact URL 7. Prefix and suffix 8. Suffix only 9. Prefix only 10. Default redirectURL The URL where traffic is redirected if the virtual server in system becomes unavailable. WARNING! Make sure that the domain you specify in the URL does not match the domain specified in the -d domainName argument of the ###add cs policy### command. If the same domain is specified in both arguments, the request will be continuously redirected to the same unavailable virtual server in the system. If so, the user may not get the requested content. authentication Indicates whether or not authentication is being applied to incoming users to the VPN. doubleHop Indicates whether double hop functionality is enabled or not. icaOnly Indicates whether or ica only license feature is enabled or not. maxAAAUsers The maximum number of concurrent users allowed to login into this vserver at a time. curAAAUsers The number of current users logged in to this vserver. domain The domain name of the server for which a service needs to be added. If the IP Address has been specified, the domain name does not need to be specified. rule The name of the rule, or expression, if any, that policy for the vpn server is to use. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied
to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. The default rule is ns_true. policyName The name of the policy, if any, bound to the vpn vserver. policy The name of the policy, if any, bound to the vpn vserver. serviceName The name of the service, if any, to which the vserver policy is bound. weight Weight for this service, if any. This weight is used when the system performs load balancing, giving greater priority to a specific service. It is useful when the services bound to a virtual server are of different capacity. cacheVserver The name of the default target cache virtual server, if any, to which requests are redirected. backupVServer The name of the backup vpn virtual server for this vpn virtual server. priority The priority, if any, of the vpn vserver policy. cltTimeout The idle time, if any, in seconds after which the client connection is terminated. soMethod VPN client applications are allocated from a block of Intranet IP addresses. That block may be exhausted after a certain number of connections. This switch specifies the method used to determine whether or not a new connection will spillover, or exhaust, the allocated block of Intranet IP addresses for that application. Possible values are CONNECTION or DYNAMICCONNECTION. CONNECTION means that a static integer value is the hard limit for the spillover threshold. The spillover threshold is described below. DYNAMICCONNECTION means that the spillover threshold is set according to the maximum number of connections defined for the vpn vserver. soThreshold VPN client applications are allocated from a block of Intranet IP addresses. That block may be exhausted after a certain number of connections. The value of this option is number of client connections after which the Mapped IP address is used as the client source IP address instead of an address from the allocated block of Intranet IP addresses. soPersistence Whether or not cookie-based site persistance is enabled for this VPN vserver. Possible values are 'ConnectionProxy', HTTPRedirect, or NONE soPersistenceTimeOut The timeout, if any, for cookie-based site persistance of this VPN vserver. actType intranetApplication The intranet vpn application. nextHopServer The name of the next hop server bound to vpn vserver. urlName The intranet url.
intranetIP The network id for the range of intranet IP addresses or individual intranet ip to be bound to the vserver. netmask The netmask of the intranet ip or range. staServer Configured Secure Ticketing Authority (STA) server. staAuthID Authority ID of the STA Server. Authority ID is used to match incoming STA Tickets in the SOCKS/CGP protocol with the right STA Server. useMIP Deprecated. See 'map' below. map Whether or not Mapped IP Addresses are ON or OFF. Mapped IP addresses are source IP addresses for the virtual servers running on the NetScaler. Mapped IP addresses are used by the system to connect to the backend servers. downStateFlush Perform delayed clean up of connections on this vserver. type Bindpoint to which the policy is bound gotoPriorityExpression Next priority expression. disablePrimaryOnDown Tells whether traffic will continue reaching backup vservers even after primary comes UP from DOWN state. Listenpolicy The string is listenpolicy configured for VPN vserver Listenpriority This parameter is the priority for listen policy of VPN Vserver. tcpProfileName The name of the TCP profile. httpProfileName Name of the HTTP profile. policySubType stateflag flags comment Comments associated with this virtual server. appflowLog Enable logging appflow flow information icmpVsrResponse Can be active or passive count
Example show vpn vserver Related Commands add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver stat vpn vserver rename vpn vserver
stat vpn vserver

Synopsis stat vpn vserver [<name>] [-detail] [-fullValues] [-ntimes <positive_integer>] [-logFile <input_filename>] Description Display vpn vserver statistics. Arguments name The name of the vserver for which statistics will be displayed. If not given statistics are shown for all vpn vservers. count devno stateflag IP address (IP) The IP address on which the service is running. Port (port) The port on which the service is running. Vserver protocol (Protocol) Protocol associated with the vserver State Current state of the server. Requests (Req) Total number of requests received on this service or virtual server. (This applies to HTTP/SSL services and servers.) Responses (Rsp) Number of responses received on this service or virtual server. (This applies to HTTP/SSL services and servers.)
Request bytes (Reqb) Total number of request bytes received on this service or virtual server. Response bytes (Rspb) Number of response bytes received by this service or virtual server. Example
Related Commands add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver show vpn vserver rename vpn vserver stat vpn
rename vpn vserver

Synopsis rename vpn vserver <name>@ <newName>@ Description Rename a content virtual server. Arguments name The name of the content switching virtual server. newName The new name of the virtual server. Example rename vpn vserver vpn1 vpn1new Related Commands add vpn vserver rm vpn vserver set vpn vserver unset vpn vserver enable vpn vserver disable vpn vserver show vpn vserver
stat vpn vserver
add vpn intranetApplication

Synopsis add vpn intranetApplication <intranetApplication> [<protocol>] ((<destIP> [-netmask <netmask>]) | <IPRange> | <hostName> | (-clientApplication <string> ... [-spoofIIP ( ON | OFF )])) [-destPort <port[-port]>] [-interception ( PROXY | TRANSPARENT ) [-srcIP <ip_addr>] [-srcPort <port>]] Description Add an intranet application. Arguments intranetApplication The name for the new vpn intranet application. protocol The protocol of the intranet application, e.g. TCP, UDP or ANY. Possible values: TCP, UDP, ANY destIP The destination IP address for the application. This address is the real application server IP address. clientApplication The names of the client applications destPort The destination TCP or UDP port range. Minimum value: 1 interception The interception type, e.g. proxy or transparent Possible values: PROXY, TRANSPARENT srcIP This is the source IP address of the client application. If not optionally specified, the default is 127.0.0.1. srcPort The source application TCP or UDP port. Minimum value: 1 Example
Related Commands rm vpn intranetApplication show vpn intranetApplication
rm vpn intranetApplication
Synopsis rm vpn intranetApplication <intranetApplication> Description Remove a configured intranet application. Arguments intranetApplication
The name of the vpn intranet application to remove. Example
Related Commands add vpn intranetApplication show vpn intranetApplication
show vpn intranetApplication

Synopsis show vpn intranetApplication [<intranetApplication>] Description Display the configured vpn intranet applications. Arguments intranetApplication The name for the new vpn intranet application. summary fullValues format level protocol The IP protocol, e.g. TCP, UDP or ANY destIP The destination IP address. netmask The destination netmask. IPAddress The IP address for the application. This address is the real application server IP address. hostName Name based interception. Names should be valid dns or wins names and will be resolved during interception on the sslvpn. destPort The destination port. clientApplication The names of the client applications spoofIIP This specifies whether to spoof this application on the client. interception The interception type, e.g. proxy or transparent. srcIP The source IP address.
srcPort The source port. stateflag count Example
Related Commands add vpn intranetApplication rm vpn intranetApplication
add vpn nextHopServer

Synopsis add vpn nextHopServer <name> <nextHopIP> <nextHopPort> [-secure ( ON | OFF )] Description Add an next hop server. Arguments name Configures new vpn next hop server. nextHopIP Configures next hop IP address. nextHopPort Configures next hop port number. secure Configures next hop over secure connection. Possible values: ON, OFF Default value: OFF Example add vpn nexthopserver dh1 10.1.1.1 80 -secure OFF Related Commands rm vpn nextHopServer show vpn nextHopServer
rm vpn nextHopServer
Synopsis rm vpn nextHopServer <name> Description Remove vpn next hop server. Arguments name
The name of the vpn next hop server to be removed. Example rm vpn nexthopserver dh1 Related Commands add vpn nextHopServer show vpn nextHopServer
show vpn nextHopServer

Synopsis show vpn nextHopServer [<name>] Description Display the configured vpn next hop servers. Arguments name Configures new vpn next hop server. summary fullValues format level nextHopIP Next hop IP address. nextHopPort Next hop port number. secure Next hop over secure connection. stateflag count Example show vpn nexthopserver dh1 Related Commands add vpn nextHopServer rm vpn nextHopServer
add vpn trafficPolicy

Synopsis add vpn trafficPolicy <name> <rule> <action>
Description Add a traffic policy. A traffic policy conditionally sets VPN traffic characteristics at run time. Arguments name The name for the new vpn traffic policy. rule The rule to be used by the vpn traffic policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The action to be applied by the policy if its rule is matched. Example
Related Commands rm vpn trafficPolicy set vpn trafficPolicy unset vpn trafficPolicy show vpn trafficPolicy
rm vpn trafficPolicy
Synopsis rm vpn trafficPolicy <name> Description Remove a vpn traffic policy. Arguments name The name of the vpn traffic policy to be removed. Example
Related Commands add vpn trafficPolicy set vpn trafficPolicy unset vpn trafficPolicy show vpn trafficPolicy
set vpn trafficPolicy

Synopsis set vpn trafficPolicy <name> [-rule <expression>] [-action <string>]
Description Change the properties of an existing traffic policy. Arguments name The name of the policy. rule The new rule to be used in the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new action to be applied by the policy. Example
Related Commands add vpn trafficPolicy rm vpn trafficPolicy unset vpn trafficPolicy show vpn trafficPolicy
unset vpn trafficPolicy

Synopsis unset vpn trafficPolicy <name> [-rule] [-action] Description Use this command to remove vpn trafficPolicy settings.Refer to the set vpn trafficPolicy command for meanings of the arguments. Arguments Example
Related Commands add vpn trafficPolicy rm vpn trafficPolicy set vpn trafficPolicy show vpn trafficPolicy
show vpn trafficPolicy

Synopsis show vpn trafficPolicy [<name>]
Description Display vpn traffic policies. Arguments name The name of the vpn trafiic policy. summary fullValues format level rule The rule used by the vpn traffic policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide action The action to be performed when the rule is matched. boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag Example
Related Commands add vpn trafficPolicy rm vpn trafficPolicy set vpn trafficPolicy unset vpn trafficPolicy
add vpn trafficAction

Synopsis add vpn trafficAction <name> <qual> [-appTimeout <mins>] [(-SSO ( ON | OFF ) [-formSSOAction <string>]) | wanscaler ( ON | OFF )] [-fta ( ON | OFF )] Description Create a vpn traffic action. A vpn traffic action defines the characteristics of run time VPN traffic.
Arguments name The name for the action. qual The protocol to be set with the action, e.g. http or tcp. Possible values: http, tcp appTimeout The inactivity timeout after which the system closes a connection. Minimum value: 1 Maximum value: 715827 SSO Enable or disable Single Sign-On Possible values: ON, OFF formSSOAction Name of configured vpn formssoaction fta Enable or disable file-type association Possible values: ON, OFF wanscaler Enable or disable Repeater Possible values: ON, OFF Example
Related Commands rm vpn trafficAction set vpn trafficAction unset vpn trafficAction show vpn trafficAction
rm vpn trafficAction
Synopsis rm vpn trafficAction <name> Description Remove a previously created traffic action. Arguments name The name of the action to be removed. Example
Related Commands add vpn trafficAction set vpn trafficAction unset vpn trafficAction show vpn trafficAction
set vpn trafficAction

Synopsis set vpn trafficAction <name> [-appTimeout <mins>] [-SSO ( ON | OFF ) | -wanscaler ( ON | OFF )] [formSSOAction <string>] [-fta ( ON | OFF )] Description Modifies a vpn traffic action. A vpn traffic action defines the characteristics of run time VPN traffic. Arguments name The name for the action. appTimeout The inactivity timeout after which the system closes a connection. Minimum value: 1 Maximum value: 715827 SSO switch to turn on the SSO engine for HTTP traffic. Possible values: ON, OFF formSSOAction Name of configured vpn formssoaction fta Enable or disable file-type association Possible values: ON, OFF wanscaler Enable or disable Repeater Possible values: ON, OFF Example
Related Commands add vpn trafficAction rm vpn trafficAction unset vpn trafficAction show vpn trafficAction
unset vpn trafficAction

Synopsis unset vpn trafficAction <name> -wanscaler Description Use this command to remove vpn trafficAction settings.Refer to the set vpn trafficAction command for meanings of the arguments. Arguments Example
Related Commands add vpn trafficAction rm vpn trafficAction set vpn trafficAction show vpn trafficAction
show vpn trafficAction

Synopsis show vpn trafficAction [<name>] Description Display the configured vpn traffic action(s). Arguments name The name of the vpn trafiic action. summary fullValues format level qual The protocol that is set with the action, e.g. http or tcp. appTimeout The application timeout SSO Whether or not Single Sign On is enabled. formSSOAction Name of configured vpn formssoaction fta Whether or not file-type association is enabled. wanscaler Enable or disable Repeater stateflag count Example
Related Commands add vpn trafficAction rm vpn trafficAction
set vpn trafficAction unset vpn trafficAction
add vpn formSSOAction

Synopsis add vpn formSSOAction <name> -actionURL <URL> -userField <string> -passwdField <string> -ssoSuccessRule <expression> [-nameValuePair <string>] [-responsesize <positive_integer>] [-nvtype ( STATIC | DYNAMIC )] [submitMethod ( GET | POST )] Description Create a formsso action. A formsso action defines the characteristics of the form. Arguments name The name for the action. actionURL The url to which form will be submitted. userField Username field in the form to be filled with sessions username. passwdField Password field in the form to be filled with sessions username. ssoSuccessRule The rule to be used to check whether sso is successfull or not . Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. nameValuePair Name Value pairs to be submitted. Name value pairs have to separated by '&'. EX: name1=value1&name2=value2 responsesize Size of the body to be parsed to get the forms. Default value: 8096 nvtype Bypass Form extraction. Possible values: STATIC, DYNAMIC Default value: NS_ACT_FSSO_NV_DYNAMIC submitMethod submit method Possible values: GET, POST Default value: NS_ACT_FSSO_SUBMIT_GET Example
Related Commands rm vpn formSSOAction set vpn formSSOAction unset vpn formSSOAction show vpn formSSOAction
rm vpn formSSOAction
Synopsis rm vpn formSSOAction <name> Description Delete a previously created session action. Arguments name The Form sso action to be removed. Example
Related Commands add vpn formSSOAction set vpn formSSOAction unset vpn formSSOAction show vpn formSSOAction
set vpn formSSOAction

Synopsis set vpn formSSOAction <name> [-actionURL <URL>] [-userField <string>] [-passwdField <string>] [ssoSuccessRule <expression>] [-responsesize <positive_integer>] [-nameValuePair <string>] [-nvtype ( STATIC | DYNAMIC )] [-submitMethod ( GET | POST )] Description Create a vpn traffic action. A vpn traffic action defines the characteristics of run time VPN traffic. Arguments name The name for the action. actionURL Set the url to which form will be submitted. userField Set the username field. passwdField Set the password field. ssoSuccessRule Set the success rule. responsesize Set the body size to be parsed Default value: 8096 nameValuePair Set the name value pair.
nvtype Bypass Form extraction. Possible values: STATIC, DYNAMIC Default value: NS_ACT_FSSO_NV_DYNAMIC submitMethod Submit method. Possible values: GET, POST Default value: NS_ACT_FSSO_SUBMIT_GET Example
Related Commands add vpn formSSOAction rm vpn formSSOAction unset vpn formSSOAction show vpn formSSOAction
unset vpn formSSOAction

Synopsis unset vpn formSSOAction <name> [-responsesize] [-nameValuePair] [-nvtype] [-submitMethod] Description Use this command to remove vpn formSSOAction settings.Refer to the set vpn formSSOAction command for meanings of the arguments. Arguments Example
Related Commands add vpn formSSOAction rm vpn formSSOAction set vpn formSSOAction show vpn formSSOAction
show vpn formSSOAction

Synopsis show vpn formSSOAction [<name>] Description Display Form SSO action details. Arguments name The name for the action. summary fullValues
format level actionURL The url to which form will be submitted. userField Username field. passwdField Password field. responsesize Size of the body to be parsed to get the forms. nameValuePair Form attributes and their values to be submitted. nvtype Bypass Form extraction ssoSuccessRule Rule to be evaluated to check whether sso succeeded or not. submitMethod Form Submit method. count stateflag Example
Related Commands add vpn formSSOAction rm vpn formSSOAction set vpn formSSOAction unset vpn formSSOAction
add vpn url

Synopsis add vpn url <urlName> <linkName> <actualURL> [-clientlessAccess ( ON | OFF )] [-comment <string>] Description Add vpn urls. A vpn url provides a link to intranet resources on the vpn portal page. Arguments urlName The name for the new vpn url. linkName The display name for the vpn url. This is the name that will display in the bookmark links in the vpn portal page.
actualURL The actual URL that the vpn url points to. clientlessAccess Enable clientless access for the URL in other VPN modes if permitted. In clientless mode of VPN, it is enabled by default. Possible values: ON, OFF Default value: OFF comment Comments associated with this vpn url entity. Example add vpn url ggl search www.google.com. Related Commands rm vpn url set vpn url unset vpn url show vpn url
rm vpn url
Synopsis rm vpn url <urlName> Description Remove vpn urls. Arguments urlName The name of the vpn url to be removed. Example rm vpn url ggl Related Commands add vpn url set vpn url unset vpn url show vpn url
set vpn url

Synopsis set vpn url <urlName> [-linkName <string>] [-actualURL <string>] [-clientlessAccess ( ON | OFF )] [-comment <string>] Description Modifies a vpn url. A vpn url provides a link to intranet resources on the vpn portal page.
Arguments urlName The name of the vpn url to be modified. linkName The display name for the vpn url. This is the name that will display in the bookmark links in the vpn portal page. actualURL The actual URL that the vpn url points to. clientlessAccess Enable or disable clientless access mode for the url in other modes. Possible values: ON, OFF Default value: OFF comment Comments associated with this vpn url entity. Example set vpn url wiurl -clientlessAccess on Related Commands add vpn url rm vpn url unset vpn url show vpn url
unset vpn url

Synopsis unset vpn url <urlName> [-clientlessAccess] [-comment] Description Use this command to remove vpn url settings.Refer to the set vpn url command for meanings of the arguments. Arguments Example
Related Commands add vpn url rm vpn url set vpn url show vpn url
show vpn url

Synopsis show vpn url [<urlName>]
Description Display the configured vpn urls. Arguments urlName The name for the new vpn url. summary fullValues format level linkName The display name for the vpn url. This is the name that will display in the bookmark links in the vpn portal page. actualURL The actual URL that the vpn url points to. clientlessAccess Whether clientless access is enabled for the url in other modes or not. comment Comments associated with this virtual server. count stateflag Example
Related Commands add vpn url rm vpn url set vpn url unset vpn url
add vpn sessionPolicy

Synopsis add vpn sessionPolicy <name> <rule> <action> Description Add a vpn session policy, which conditionally sets characteristics of a vpn session upon session establishment. Arguments name The name for the new vpn session policy. rule
The rule to be evaluated in the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The action to be performed when the rule is matched. Example
Related Commands rm vpn sessionPolicy set vpn sessionPolicy unset vpn sessionPolicy show vpn sessionPolicy
rm vpn sessionPolicy
Synopsis rm vpn sessionPolicy <name> Description Remove a previously created vpn session policy. Arguments name The name of the policy to be removed. Example
Related Commands add vpn sessionPolicy set vpn sessionPolicy unset vpn sessionPolicy show vpn sessionPolicy
set vpn sessionPolicy

Synopsis set vpn sessionPolicy <name> [-rule <expression>] [-action <string>] Description Modify the rule or action of a vpn session policy. Arguments name The name of the vpn session policy. rule
The new rule to be associated with the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new vpn session action for the policy. Example
Related Commands add vpn sessionPolicy rm vpn sessionPolicy unset vpn sessionPolicy show vpn sessionPolicy
unset vpn sessionPolicy

Synopsis unset vpn sessionPolicy <name> [-rule] [-action] Description Use this command to remove vpn sessionPolicy settings.Refer to the set vpn sessionPolicy command for meanings of the arguments. Arguments Example
Related Commands add vpn sessionPolicy rm vpn sessionPolicy set vpn sessionPolicy show vpn sessionPolicy
show vpn sessionPolicy

Synopsis show vpn sessionPolicy [<name>] Description Display the configured vpn session policies. Arguments name The name of the vpn session policy. summary fullValues
format level rule The new rule associated with the policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. action The new vpn session action the policy is using. boundTo The entity name to which policy is bound activePolicy priority bindPolicyType policyType count stateflag Example
Related Commands add vpn sessionPolicy rm vpn sessionPolicy set vpn sessionPolicy unset vpn sessionPolicy
add vpn sessionAction

Synopsis add vpn sessionAction <name> [-httpPort <port> ...] [-winsIP <ip_addr>] [-dnsVserverName <string>] [splitDns <splitDns>] [-sessTimeout <mins>] [-clientSecurity <expression> [-clientSecurityGroup <string>] [-clientSecurityMessage <string>]] [-clientSecurityLog ( ON | OFF )] [-splitTunnel <splitTunnel>] [localLanAccess ( ON | OFF )] [-rfc1918 ( ON | OFF )] [-spoofIIP ( ON | OFF )] [-killConnections ( ON | OFF )] [-transparentInterception ( ON | OFF )] [-defaultAuthorizationAction ( ALLOW | DENY )] [-authorizationGroup <string>] [-clientIdleTimeout <mins>] [-proxy <proxy>] [-allProtocolProxy <string> | -httpProxy <string> | -ftpProxy <string> | -socksProxy <string> | -gopherProxy <string> | -sslProxy <string>] [-proxyException <string>] [-proxyLocalBypass ( ENABLED | DISABLED )] [-clientCleanupPrompt ( ON | OFF )] [-forceCleanup <forceCleanup> ...] [-clientOptions <clientOptions> ...] [-clientConfiguration <clientConfiguration> ...] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-windowsAutoLogon ( ON | OFF )] [-useMIP ( NS | OFF )] [-useIIP <useIIP>] [-clientDebug <clientDebug>] [-loginScript <input_filename>] [-logoutScript <input_filename>] [-homePage <URL>] [-icaProxy ( ON | OFF )] [-wihome <URL>] [-citrixReceiverHome <URL>] [-wiPortalMode ( NORMAL | COMPACT )] [-ClientChoices ( ON | OFF )] [-iipDnsSuffix <string>] [-forcedTimeout <mins>] [-forcedTimeoutWarning <mins>] [-ntDomain <string>] [-clientlessVpnMode <clientlessVpnMode>] [emailHome <URL>] [-clientlessModeUrlEncoding <clientlessModeUrlEncoding>] [-clientlessPersistentCookie <clientlessPersistentCookie>] [-allowedLoginGroups <string>]
Description Create a session action, which defines the properties of a VPN session. Arguments name The name for the new vpn session action. httpPort The http port number for this session. Minimum value: 1 winsIP The WINS server ip address for this session. dnsVserverName The name of the DNS vserver to be configured by the session action. splitDns Set the VPN client to route the DNS requests to remote network or local network or both. Possible values: LOCAL, REMOTE, BOTH sessTimeout The session timeout, in minutes, to be set by the action. Minimum value: 1 clientSecurity The client security check string to be applied. This is in the form of an Expression. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. clientSecurityLog Controls client side logging of security checks. Possible values: ON, OFF splitTunnel The split tunnel state, e.g. ON, OFF or REVERSE. Split Tunnelling ON enables the VPN client to route non-VPN traffic through its local network interface. When Split Tunnelling is OFF, no traffic may go to the local interface while the client session is active. Split tunneling can also be set to REVERSE. In this case all traffic directed to domains configured on the system will bypass the VPN tunnel. All other traffic is forced through the VPN tunnel. Possible values: ON, OFF, REVERSE localLanAccess Finer grained local lan access. ON or OFF. splitTunnel, when OFF, permits no traffic to be routed to the client's local interface. But if, in addition, localLanAccess is turned ON, the client MAY route traffic to its local interface. This combination of switches is useful primarily when the rfc1918 switch is also specified. In this fashion, the client may restrict local lan access to devices which commonly have non-routable addresses, such as local printers or local file servers. Possible values: ON, OFF rfc1918 Only allow RFC1918 local addresses when local LAN access feature is enabled. Possible values: ON, OFF spoofIIP Controls the Spoofing of Intranet IP to the Windows Applications by Windows VPN client when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. Possible values: ON, OFF killConnections Determines whether Windows VPN client should kill all pre-existing connections (ie, the connections existing before the end user logged in to SSL VPN) and prevent new incoming connections on the Windows Client system when the end-user is connected to SSL VPN in 'splittunnel OFF' mode. Possible values: ON, OFF
transparentInterception The transparent interception state, e.g. ON or OFF. Possible values: ON, OFF windowsClientType Choose between two types of Windows Client\ a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed\ b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN defaultAuthorizationAction This toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY authorizationGroup The authorization group to be applied to the session. clientIdleTimeout Defines the client idle timeout value. Measured in minutes, the client idle timeout default is 20 minutes and meters a client session's keyboard and mouse inactivity. Minimum value: 1 Maximum value: 9999 proxy Enables or disables use of a proxy configuration in the session. Possible values: BROWSER, NS, OFF allProtocolProxy Sets the address to use for all proxies. httpProxy Sets the HTTP proxy IP address. ftpProxy Defines the FTP proxy IP address. socksProxy The SOCKS proxy IP address. gopherProxy Sets the Gopher proxy IP address. sslProxy Sets the HTTPS proxy IP address. proxyException Proxy Exception string that will be configured in the Browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser. proxyLocalBypass Bypass proxy server for local addresses option in IE proxy server settings will be enabled Possible values: ENABLED, DISABLED clientCleanupPrompt Toggles the prompt for client clean up on a client intitiated session close. Possible values: ON, OFF forceCleanup The client side items for force cleanup on session close. Options are: none, all, cookie, addressbar, plugin, filesystemapplication, addressbar, application, clientcertificate, applicationdata, and autocomplete. You may specify all or none alone or any combination of the client side items. clientOptions
Display only configured buttons(and/or menu options in the docked client) in the Windows VPN client.\ Options:\ none\ none of the Windows Client's buttons/menu options (except logout) are displayed.\ all\ all of the Windows Client's buttons/menu options are displayed.\ \ One or more of the following\ services\ only the "Services" button/menu option is displayed.\ filetransfer\ only the "File Transfer" button/menu option is displayed.\ configuration\ only the "Configuration" button/ menu option is displayed. clientConfiguration Display only configured tabs in the Windows VPN client.\ Options:\ none\ none of the Windows Client's tabs(except About) are displayed.\ all\ all of the Windows Client's tabs (except "Resptime") are displayed.\ \ One or more of the following\ general\ only the "General" tab is displayed.\ tunnel \ only the "Tunnel" tab is displayed.\ trace\ only the "Trace" tab is displayed.\ compression\ only the "Compression" tab is displayed.\ resptime\ only the "Resptime" tab is displayed. SSO Enables or disables the use of Single Sign-on for the session. Possible values: ON, OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY windowsAutoLogon Enables or disables the Windows Auto Logon for the session. Possible values: ON, OFF useMIP Enables or disables the use of a Mapped IP address for the session Possible values: NS, OFF useIIP Controls how the intranet IP module is configured for usage. \ Options:\ SPILLOVER\ specifies that iip is ON and when we can't assign an intranet IP to an entity, which has other instances active, we spill over to using Mapped IP.\ NOSPILLOVER\ specifies that iip is ON and when we can't assign intranet IP to an entity, which has other instances active, then we initiate transfer login.\ OFFn specifies that intranet IP module won't be activated for this entity. Possible values: NOSPILLOVER, SPILLOVER, OFF clientDebug Sets the trace level on the Windows VPN Client.\ Options:\ debugn\ Detailed debug messages are collected are written into the specified file.\ stats\ Application audit level error messages and debug statistic counters are written into the specified file.\ events\ Application audit level error messages are written into the specified file.\ off\ Only critical events are logged into the Windows Application Log. Possible values: debug, stats, events, OFF loginScript Login script path. logoutScript Logout script path. homePage Sets the client home page. Setting this parameter overrides serving the default portal page to SSL VPN users with the URL specified here. icaProxy Enable ICA proxy mode. This can be used to enable Secure Gateway functionality for the Web Interface. If enabled, a VPN homepage that points to a Web Interface in SG mode, has to be configured. Possible values: ON, OFF wihome Sets the home page of wi interface. Used only in conjunction with icaProxy ON. If clientChoices is ON, wiHome has to be configured. Since the end user is given a choice between FullClient and
ICAProxy the homepage/landing page for each of these options could be different i.e. for FullClient it could be a Intranet web site and for the ICAProxy choice it will be a Web Interface web site. Hence we don't presume wihome == homepage. citrixReceiverHome Sets the home page of apprecvr interface. wiPortalMode WI layout on the VPN portal. Possible values: NORMAL, COMPACT ClientChoices Enables user to select different clients by displaying a set of options in a html page. The different client can be a) agent b) plugin c) wimode. Possible values: ON, OFF epaClientType Choose between two types of End point Windows Client a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN iipDnsSuffix Configure the IntranetIP DNS suffix. When a user logs into SSL-VPN, an A record is added to the DNS cache, after appending the configured IntranetIP DNS suffix to the username. forcedTimeout Maximum number of minutes a session is allowed to persist. Minimum value: 1 Maximum value: 255 forcedTimeoutWarning Number of minutes to warn a user before their session is removed by a forced time out. Minimum value: 1 Maximum value: 255 ntDomain NT domain to use with Smart Access when User Principle Name is not extracted from Active Directory clientlessVpnMode Whether clientlessVPN is available to the session. ON will make the session clientless and no client will be downloaded OFF will download the client but the clientlessVPN will also be available DISABLED will disable clientlessVPN altogether. Possible values: ON, OFF, DISABLED emailHome Sets the EMail home for the portal clientlessModeUrlEncoding URL encoding to be used in clientless mode. No encoding will be done for TRANSPARENT. Protocol and domain will be encoded or encrypted with OPAQUE or ENCRYPT respectively. Possible values: TRANSPARENT, OPAQUE, ENCRYPT clientlessPersistentCookie Controls the use of persistent cookie in clientless mode. ALLOW lets cookie to be stored on disk. DENY prevents usage of persistent cookie. PROMPT lets VPN user choose whether persistent cookie should be used or not. Possible values: ALLOW, DENY, PROMPT allowedLoginGroups The groups allowed login to VPN Example
Related Commands rm vpn sessionAction set vpn sessionAction unset vpn sessionAction show vpn sessionAction
rm vpn sessionAction
Synopsis rm vpn sessionAction <name> Description Delete a previously created session action. Arguments name The vpn session action to be removed. Example Related Commands add vpn sessionAction set vpn sessionAction unset vpn sessionAction show vpn sessionAction
set vpn sessionAction

Synopsis set vpn sessionAction <name> [-httpPort <port> ...] [-winsIP <ip_addr>] [-dnsVserverName <string>] [splitDns <splitDns>] [-sessTimeout <mins>] [-clientSecurity <expression> [-clientSecurityGroup <string>] [-clientSecurityMessage <string>]] [-clientSecurityLog ( ON | OFF )] [-splitTunnel <splitTunnel>] [localLanAccess ( ON | OFF )] [-rfc1918 ( ON | OFF )] [-spoofIIP ( ON | OFF )] [-killConnections ( ON | OFF )] [-transparentInterception ( ON | OFF )] [-defaultAuthorizationAction ( ALLOW | DENY )] [-authorizationGroup <string>] [-clientIdleTimeout <mins>] [-proxy <proxy>] [-allProtocolProxy <string> | -httpProxy <string> | -ftpProxy <string> | -socksProxy <string> | -gopherProxy <string> | -sslProxy <string>] [-proxyException <string>] [-proxyLocalBypass ( ENABLED | DISABLED )] [-clientCleanupPrompt ( ON | OFF )] [-forceCleanup <forceCleanup> ...] [-clientOptions <clientOptions> ...] [-clientConfiguration <clientConfiguration> ...] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-windowsAutoLogon ( ON | OFF )] [-useMIP ( NS | OFF )] [-useIIP <useIIP>] [-clientDebug <clientDebug>] [-loginScript <input_filename>] [-logoutScript <input_filename>] [-homePage <URL>] [-icaProxy ( ON | OFF )] [-wihome <URL>] [-citrixReceiverHome <URL>] [-wiPortalMode ( NORMAL | COMPACT )] [-ClientChoices ( ON | OFF )] [-iipDnsSuffix <string>] [-forcedTimeout <mins>] [-forcedTimeoutWarning <mins>] [-ntDomain <string>] [-clientlessVpnMode <clientlessVpnMode>] [emailHome <URL>] [-clientlessModeUrlEncoding <clientlessModeUrlEncoding>] [-clientlessPersistentCookie <clientlessPersistentCookie>] [-allowedLoginGroups <string>] Description Modify a session action, which defines the properties of a VPN session. Arguments name The name of the vpn session action. httpPort
The http port number for this session. Minimum value: 1 winsIP The WINS server ip address. dnsVserverName The name of the DNS vserver to be configured by the session action. splitDns Set the VPN client to route the DNS requests to remote network or local network or both. Possible values: LOCAL, REMOTE, BOTH sessTimeout The session timeout, in minutes, to be set by the action. Minimum value: 1 clientSecurity The client security check string to be applied. This is in the form of an Expression. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. clientSecurityLog Controls client side logging of security checks. Possible values: ON, OFF splitTunnel The split tunnel state, e.g. ON, OFF or REVERSE. Split Tunnelling ON enables the VPN client to route non-VPN traffic through its local network interface. When Split Tunnelling is OFF, no traffic may go to the local interface while the client session is active. Split tunneling can also be set to REVERSE. In this case all traffic directed to domains configured on the system will bypass the VPN tunnel. All other traffic is forced through the VPN tunnel. Possible values: ON, OFF, REVERSE localLanAccess Finer grained local lan access. ON or OFF. splitTunnel, when OFF, permits no traffic to be routed to the client's local interface. But if, in addition, localLanAccess is turned ON, the client MAY route traffic to its local interface. This combination of switches is useful primarily when the rfc1918 switch is also specified. In this fashion, the client may restrict local lan access to devices which commonly have non-routable addresses, such as local printers or local file servers. Possible values: ON, OFF rfc1918 Only allow RFC1918 local addresses when local LAN access feature is enabled Possible values: ON, OFF spoofIIP Controls the Spoofing of Intranet IP to the Windows Applications by Windows VPN client when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. Possible values: ON, OFF killConnections Determines whether Windows VPN client should kill all pre-existing connections (ie, the connections existing before the end user logged in to SSL VPN) and prevent new incoming connections on the Windows Client system when the end-user is connected to SSL VPN in 'splittunnel OFF' mode. Possible values: ON, OFF transparentInterception The transparent interception state, e.g. ON or OFF. Possible values: ON, OFF windowsClientType Choose between two types of Windows Client\ a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently
when installed\ b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN defaultAuthorizationAction This toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY authorizationGroup The authorization group to be applied to the session. clientIdleTimeout Defines the client idle timeout value. Measured in minutes, the client idle timeout default is 20 minutes and meters a client session's keyboard and mouse inactivity. Minimum value: 1 Maximum value: 9999 proxy Enables or disables use of a proxy configuration in the session. Possible values: BROWSER, NS, OFF allProtocolProxy Sets the address to use for all proxies. httpProxy Sets the HTTP proxy IP address. ftpProxy Defines the FTP proxy IP address. socksProxy The SOCKS proxy IP address. gopherProxy Sets the Gopher proxy IP address. sslProxy Sets the HTTPS proxy IP address. proxyException Proxy Exception string that will be configured in the Browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser. proxyLocalBypass Bypass proxy server for local addresses option in IE proxy server settings will be enabled Possible values: ENABLED, DISABLED clientCleanupPrompt Toggles the prompt for client clean up on a client intitiated session close. Possible values: ON, OFF forceCleanup The client side items for force cleanup on session close. Options are: none, all, cookie, addressbar, plugin, filesystemapplication, addressbar, application, clientcertificate, applicationdata, and autocomplete. You may specify all or none alone or any combination of the client side items. clientOptions Display only configured buttons(and/or menu options in the docked client) in the Windows VPN client.\ Options:\ none\ none of the Windows Client's buttons/menu options (except logout) are displayed.\ all\ all of the Windows Client's buttons/menu options are displayed.\ \ One or more of the following\ services\ only the "Services" button/menu option is displayed.\ filetransfer\ only the "File Transfer" button/menu option is displayed.\ configuration\ only the "Configuration" button/ menu option is displayed. clientConfiguration
Display only configured tabs in the Windows VPN client.\ Options:\ none\ none of the Windows Client's tabs(except About) are displayed.\ all\ all of the Windows Client's tabs (except "Resptime") are displayed.\ \ One or more of the following\ general\ only the "General" tab is displayed.\ tunnel \ only the "Tunnel" tab is displayed.\ trace\ only the "Trace" tab is displayed.\ compression\ only the "Compression" tab is displayed.\ resptime\ only the "Resptime" tab is displayed. SSO Enables or disables the use of Single Sign-on for the session. Possible values: ON, OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY windowsAutoLogon Enables or disables the Windows Auto Logon for the session. Possible values: ON, OFF useMIP Enables or disables the use of a Mapped IP address for the session Possible values: NS, OFF useIIP Controls how the intranet IP module is configured for usage. \ Options:\ SPILLOVER\ specifies that iip is ON and when we can't assign an intranet IP to an entity, which has other instances active, we spill over to using Mapped IP.\ NOSPILLOVER\ specifies that iip is ON and when we can't assign intranet IP to an entity, which has other instances active, then we initiate transfer login.\ OFFn specifies that intranet IP module won't be activated for this entity. Possible values: NOSPILLOVER, SPILLOVER, OFF clientDebug Sets the trace level on the Windows VPN Client.\ Options:\ debugn\ Detailed debug messages are collected are written into the specified file.\ stats\ Application audit level error messages and debug statistic counters are written into the specified file.\ events\ Application audit level error messages are written into the specified file.\ off\ Only critical events are logged into the Windows Application Log. Possible values: debug, stats, events, OFF loginScript Login script path. logoutScript Logout script path. homePage Sets the client home page. Setting this parameter overrides serving the default portal page to SSL VPN users with the URL specified here. icaProxy Enable ICA proxy mode. This can be used to enable Secure Gateway functionality for the Web Interface. If enabled, a VPN homepage that points to a Web Interface in SG mode, has to be configured. Possible values: ON, OFF Default value: OFF wihome Sets the home page of wi interface. Used only in conjunction with icaProxy ON. If clientChoices is ON, wiHome has to be configured. Since the end user is given a choice between FullClient and ICAProxy the homepage/landing page for each of these options could be different i.e. for FullClient it could be a Intranet web site and for the ICAProxy choice it will be a Web Interface web site. Hence we don't presume wihome == homepage. citrixReceiverHome Sets the home page of apprecvr interface. wiPortalMode
WI layout on the VPN portal. Possible values: NORMAL, COMPACT ClientChoices Enables user to select different clients by displaying a set of options in a html page. The different client can be a) agent b) plugin c) wimode. Possible values: ON, OFF epaClientType Choose between two types of End point Windows Client a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN iipDnsSuffix Configure the IntranetIP DNS suffix. When a user logs into SSL-VPN, an A record is added to the DNS cache, after appending the configured IntranetIP DNS suffix to the username. forcedTimeout Maximum number of minutes a session is allowed to persist. Minimum value: 1 Maximum value: 255 forcedTimeoutWarning Number of minutes to warn a user before their session is removed by a forced time out. Minimum value: 1 Maximum value: 255 ntDomain NT domain to use with Smart Access when User Principle Name is not extracted from Active Directory clientlessVpnMode Whether clientlessVPN is available to the session. ON will make the session clientless and no client will be downloaded OFF will download the client but the clientlessVPN will also be available DISABLED will disable clientlessVPN altogether. Possible values: ON, OFF, DISABLED Default value: VPN_SESS_ACT_CVPNMODE_OFF emailHome Sets the EMail home for the portal clientlessModeUrlEncoding URL encoding to be used in clientless mode. No encoding will be done for TRANSPARENT. Protocol and domain will be encoded or encrypted with OPAQUE or ENCRYPT respectively. Possible values: TRANSPARENT, OPAQUE, ENCRYPT clientlessPersistentCookie Controls the use of persistent cookie in clientless mode. ALLOW lets cookie to be stored on disk. DENY prevents usage of persistent cookie. PROMPT lets VPN user choose whether persistent cookie should be used or not. Possible values: ALLOW, DENY, PROMPT Default value: VPN_SESS_ACT_CVPN_PERSCOOKIE_DENY allowedLoginGroups The groups allowed login to VPN Example
Related Commands add vpn sessionAction rm vpn sessionAction unset vpn sessionAction
show vpn sessionAction
unset vpn sessionAction

Synopsis unset vpn sessionAction <name> [-httpPort] [-winsIP] [-dnsVserverName] [-splitDns] [-sessTimeout] [-clientSecurity] [-clientSecurityGroup] [-clientSecurityMessage] [-clientSecurityLog] [-splitTunnel] [localLanAccess] [-rfc1918] [-spoofIIP] [-killConnections] [-transparentInterception] [-defaultAuthorizationAction] [-authorizationGroup] [-clientIdleTimeout] [-proxy] [-allProtocolProxy] [-httpProxy] [-ftpProxy] [-socksProxy] [-gopherProxy] [-sslProxy] [-proxyException] [-proxyLocalBypass] [-clientCleanupPrompt] [-forceCleanup] [-clientOptions] [-clientConfiguration] [-SSO] [-ssoCredential] [-windowsAutoLogon] [-useMIP] [-useIIP] [-clientDebug] [-loginScript] [-logoutScript] [-homePage] [-icaProxy] [-wihome] [-citrixReceiverHome] [wiPortalMode] [-ClientChoices] [-iipDnsSuffix] [-forcedTimeout] [-forcedTimeoutWarning] [-ntDomain] [-clientlessVpnMode] [-emailHome] [-clientlessModeUrlEncoding] [-clientlessPersistentCookie] [allowedLoginGroups] Description Use this command to remove vpn sessionAction settings.Refer to the set vpn sessionAction command for meanings of the arguments. Arguments Example Related Commands add vpn sessionAction rm vpn sessionAction set vpn sessionAction show vpn sessionAction
show vpn sessionAction

Synopsis show vpn sessionAction [<name>] Description Display vpn session action details. Arguments name The name of the vpn session action. summary fullValues format level httpPort The HTTP port for this session action winsIP The WINS server IP address for this session action. dnsVserverName The name of the DNS vserver configured by the session action.
splitDns The VPN client SplitDns state. sessTimeout The session timeout, in minutes, set by the action. clientSecurity The client security check string being applied. This is in the form of an Expression. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. clientSecurityGroup The client security group that will be assigned on failure of the client security check. Users can in general be organized into Groups. In this case, the Client Security Group may have a more restrictive security policy. clientSecurityMessage The client security message that will be displayed on failure of the client security check. clientSecurityLog Controls client side logging of security checks. splitTunnel The split tunnel state, e.g. ON, OFF or REVERSE. Split Tunnelling ON enables the VPN client to route non-VPN traffic through its local network interface. When Split Tunnelling is OFF, no traffic may go to the local interface while the client session is active. Split tunneling can also be set to REVERSE. In this case all traffic directed to domains configured on the system will bypass the VPN tunnel. All other traffic is forced through the VPN tunnel. localLanAccess Finer grained local lan access. ON or OFF. splitTunnel, when OFF, permits no traffic to be routed to the client's local interface. But if, in addition, localLanAccess is turned ON, the client MAY route traffic to its local interface. This combination of switches is useful primarily when the rfc1918 switch is also specified. In this fashion, the client may restrict local lan access to devices which commonly have non-routable addresses, such as local printers or local file servers. rfc1918 Only allow RFC1918 local addresses when local LAN access feature is enabled. spoofIIP Controls the Spoofing of Intranet IP to the Windows Applications by Windows VPN client when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. killConnections Determines whether Windows VPN client should kill all pre-existing connections (ie, the connections existing before the end user logged in to SSL VPN) and prevent new incoming connections on the Windows Client system when the end-user is connected to SSL VPN in 'splittunnel OFF' mode. transparentInterception The transparent interception state, e.g. ON or OFF. windowsClientType Windows client type, e.g. Agent or ActiveX defaultAuthorizationAction The Authorization Action, e.g. allow or deny authorizationGroup The authorization group applied to client sessions.
clientIdleTimeout The client idle timeout, in minutes. clientIdleTimeoutWarning The time after which the client gets a timeout warning, in minutes. proxy The state of proxy configuration for the session. allProtocolProxy The address set for all proxies. httpProxy The HTTP proxy IP address. ftpProxy The FTP proxy IP address. socksProxy The SOCKS proxy IP address. gopherProxy The Gopher proxy IP address. sslProxy The HTTPS proxy IP address. proxyException Proxy Exception string that will be configured in the Browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser. proxyLocalBypass Bypass proxy server for local addresses option in IE proxy server settings will be enabled clientCleanupPrompt Toggles the prompt for client clean up on a client intitiated session close. forceCleanup The client side items for force cleanup on session close. Options are: none, all, cookie, addressbar, plugin, filesystemapplication, addressbar, application, clientcertificate, applicationdata, and autocomplete. You may specify all or none alone or any combination of the client side items. clientOptions List of configured buttons(and/or menu options in the docked client) in the Windows VPN client. clientConfiguration List of configured tabs in the Windows VPN client. SSO Whether or not Single Sign-On is used for this session. ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On windowsAutoLogon Whether or not Windows Auto Logon is enabled for this session. useMIP Whether or not a Mapped IP address is used for the session useIIP
Controls how the intranet IP module is configured for usage. \ Options:\ SPILLOVER\ specifies that iip is ON and when we can't assign an intranet IP to an entity, which has other instances active, we spill over to using Mapped IP.\ NOSPILLOVER\ specifies that iip is ON and when we can't assign intranet IP to an entity, which has other instances active, then we initiate transfer login.\ OFFn specifies that intranet IP module won't be activated for this entity. clientDebug Trace level on the Windows VPN Client. loginScript Login script path. logoutScript Logout script path. homePage The client home page. icaProxy Enable ICA proxy mode. This can be used to enable Secure Gateway functionality for the Web Interface. If enabled, a VPN homepage that points to a Web Interface in SG mode, has to be configured. wihome Sets the home page of wi interface. Used only in conjunction with icaProxy ON. If clientChoices is ON, wiHome has to be configured. Since the end user is given a choice between FullClient and ICAProxy the homepage/landing page for each of these options could be different i.e. for FullClient it could be a Intranet web site and for the ICAProxy choice it will be a Web Interface web site. Hence we don't presume wihome == homepage. citrixReceiverHome Sets the home page of apprecvr interface. wiPortalMode WI layout on the VPN portal. ClientChoices Enables user to select different clients by displaying a set of options in a html page. The different client can be a) agent b) plugin c) wimode. epaClientType Choose between two types of End point Windows Client a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. iipDnsSuffix The IntranetIP DNS suffix. forcedTimeout Maximum number of minutes a session is allowed to persist. forcedTimeoutWarning Number of minutes to warn a user before their session is removed by a forced time out. ntDomain NT domain to use with Smart Access when User Principle Name is not extracted from Active Directory clientlessVpnMode Whether clientlessVPN is available to the session. clientlessModeUrlEncoding
URL encoding used in clientless mode. clientlessPersistentCookie Controls the use of persistent cookie in clientless mode. ALLOW lets cookie to be stored on disk. DENY prevents usage of persistent cookie. PROMPT lets VPN user choose whether persistent cookie should be used or not. emailHome The EMail home for the portal stateflag allowedLoginGroups The groups allowed login to VPN count Example Related Commands add vpn sessionAction rm vpn sessionAction set vpn sessionAction unset vpn sessionAction
add vpn clientlessAccessPolicy

Synopsis add vpn clientlessAccessPolicy <name> <rule> <profileName> Description Add a clientless access policy. Arguments name The name for the new clientless access policy. rule The rule to be used by the clientless access policy. profileName The profile to be invoked for clientless access. Example Related Commands rm vpn clientlessAccessPolicy set vpn clientlessAccessPolicy show vpn clientlessAccessPolicy
rm vpn clientlessAccessPolicy
Synopsis rm vpn clientlessAccessPolicy <name>
Description Remove a clientless access policy. Arguments name The name of the clientless access policy to be removed. Example Related Commands add vpn clientlessAccessPolicy set vpn clientlessAccessPolicy show vpn clientlessAccessPolicy
set vpn clientlessAccessPolicy

Synopsis set vpn clientlessAccessPolicy <name> [-rule <expression>] [-profileName <string>] Description Set a new rule/profile for existing clientless access policy. Arguments name The name of the existing clientless access policy. rule The rule to be used by the clientless access policy. profileName The profile to be invoked for clientless access. Example Related Commands add vpn clientlessAccessPolicy rm vpn clientlessAccessPolicy show vpn clientlessAccessPolicy
show vpn clientlessAccessPolicy

Synopsis show vpn clientlessAccessPolicy [<name>] Description Display clientless access policies. Arguments name The name of the clientless access policy. summary fullValues
format level rule The rule used by the clientless access policy. Rules are combinations of Expressions. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide profileName The profile to invoked for the clientless access. undefAction The UNDEF action. hits The number of times the policy evaluated to true. undefHits The number of times the policy evaluation resulted in undefined processing. activePolicy Indicates whether policy is bound or not. boundTo Location where policy is bound. priority Specifies the priority of the policy. description Description of the clientless access policy. isDefault A value of true is returned if it is a default vpnclientlessrwpolicy. flags count stateflag Example Related Commands add vpn clientlessAccessPolicy rm vpn clientlessAccessPolicy set vpn clientlessAccessPolicy
add vpn clientlessAccessProfile

Synopsis add vpn clientlessAccessProfile <profileName> Description Add a clientless access profile. Arguments profileName
The name of the clientless access profile. Example Related Commands rm vpn clientlessAccessProfile set vpn clientlessAccessProfile unset vpn clientlessAccessProfile show vpn clientlessAccessProfile
rm vpn clientlessAccessProfile
Synopsis rm vpn clientlessAccessProfile <profileName> Description Remove a clientless access profile. Arguments profileName The name of the clientless access profile. Example Related Commands add vpn clientlessAccessProfile set vpn clientlessAccessProfile unset vpn clientlessAccessProfile show vpn clientlessAccessProfile
set vpn clientlessAccessProfile

Synopsis set vpn clientlessAccessProfile <profileName> [-URLRewritePolicyLabel <string>] [JavaScriptRewritePolicyLabel <string>] [-ReqHdrRewritePolicyLabel <string>] [-ResHdrRewritePolicyLabel <string>] [-RegexForFindingURLinJavaScript <string>] [-RegexForFindingURLinCSS <string>] [-RegexForFindingURLinXComponent <string>] [-RegexForFindingURLinXML <string>] [RegexForFindingCustomURLs <string>] [-ClientConsumedCookies <string>] [-requirePersistentCookie ( ON | OFF )] Description Set a policylabel on the clientless access profile. Arguments profileName The name of the clientless vpn profile. URLRewritePolicyLabel The configured URL rewrite policylabel. JavaScriptRewritePolicyLabel The configured JavaScript rewrite policylabel.
ReqHdrRewritePolicyLabel The configured Request Header rewrite policylabel. ResHdrRewritePolicyLabel The configured Response rewrite policylabel. RegexForFindingURLinJavaScript Patclass having regexes to find the URLs in JavaScript. RegexForFindingURLinCSS Patclass having regexes to find the URLs in CSS. RegexForFindingURLinXComponent Patclass having regexes to find the URLs in X-Component. RegexForFindingURLinXML Patclass having regexes to find the URLs in XML. RegexForFindingCustomURLs Patclass having regexes to find the custom URLs. ClientConsumedCookies Patclass having the client consumed Cookie names. requirePersistentCookie The flag to select Persistent cookie for the profile Possible values: ON, OFF Default value: OFF Example Related Commands add vpn clientlessAccessProfile rm vpn clientlessAccessProfile unset vpn clientlessAccessProfile show vpn clientlessAccessProfile
unset vpn clientlessAccessProfile

Synopsis unset vpn clientlessAccessProfile <profileName> [-URLRewritePolicyLabel] [-JavaScriptRewritePolicyLabel] [-ReqHdrRewritePolicyLabel] [-ResHdrRewritePolicyLabel] [-RegexForFindingURLinJavaScript] [RegexForFindingURLinCSS] [-RegexForFindingURLinXComponent] [-RegexForFindingURLinXML] [RegexForFindingCustomURLs] [-ClientConsumedCookies] [-requirePersistentCookie] Description Unset a policylabel on a clientless access profile..Refer to the set vpn clientlessAccessProfile command for meanings of the arguments. Arguments Example Related Commands add vpn clientlessAccessProfile rm vpn clientlessAccessProfile set vpn clientlessAccessProfile
show vpn clientlessAccessProfile
show vpn clientlessAccessProfile

Synopsis show vpn clientlessAccessProfile [<profileName>] Description Show clientless access profile. Arguments profileName The name of the clientless vpn profile. summary fullValues format level stateflag URLRewritePolicyLabel The configured URL rewrite policylabel. JavaScriptRewritePolicyLabel The configured JavaScript rewrite policylabel. CSSRewritePolicyLabel The configured CSS rewrite policylabel. XMLRewritePolicyLabel The configured XML rewrite policylabel. XComponentRewritePolicyLabel The configured X-Component rewrite policylabel. ReqHdrRewritePolicyLabel The configured Request Header rewrite policylabel. ResHdrRewritePolicyLabel The configured Response rewrite policylabel. RegexForFindingURLinJavaScript Patclass having regexes to find the URLs in JavaScript. RegexForFindingURLinCSS Patclass having regexes to find the URLs in CSS. RegexForFindingURLinXComponent Patclass having regexes to find the URLs in X-Component. RegexForFindingURLinXML Patclass having regexes to find the URLs in XML. RegexForFindingCustomURLs Patclass having regexes to find the custom URLs. ClientConsumedCookies Patclass having the client consumed Cookie names.
requirePersistentCookie The flag to select Persistent cookie for the profile isDefault A value of true is returned if it is a default vpnclientlessrwprofile. description Description of the clientless access profile. count Example Related Commands add vpn clientlessAccessProfile rm vpn clientlessAccessProfile set vpn clientlessAccessProfile unset vpn clientlessAccessProfile
show vpn stats

Synopsis show vpn stats - alias for 'stat vpn' Description show vpn stats is an alias for stat vpn Arguments Example Related Commands stat vpn
show vpn icaConnection

Synopsis show vpn icaConnection [-userName <string>] Description Display the active ICA connections. Arguments userName The user name. summary fullValues domain The domain name. srcIP The client IP address.
srcPort The client port. destIP The CPS server IP address. destPort The CPS server port. peId Core id of the session owner stateflag count Example Related Commands
bind vpn global

Synopsis bind vpn global [-policyName <string> [-priority <positive_integer>] [-secondary]] [-intranetDomain <string>] [intranetApplication <string>] [-nextHopServer <string>] [-urlName <string>] [-intranetIP <ip_addr> <netmask>] [staServer <URL>] Description Bind vpn entities to vpn global. Arguments policyName The name of the policy to be bound to vpn global. intranetDomain A conflicting intranet domain name. intranetApplication The vpn intranet application to be bound. nextHopServer The name of the next hop server to be bound globally. urlName The vpn url to be bound. intranetIP The intranet ip or range to be bound to VPN global. staServer Secure Ticketing Authority (STA) server, in the format 'http(s)://IP/FQDN/URLPATH' Example Related Commands unbind vpn global show vpn global
unbind vpn global

Synopsis unbind vpn global [-policyName <string> [-secondary]] [-intranetDomain <string>] [-intranetApplication <string>] [-nextHopServer <string>] [-urlName <string>] [-intranetIP <ip_addr> <netmask>] [-staServer <URL>] Description Unbind entities from vpn global. Arguments policyName The name of the policy to be unbound. intranetDomain A conflicting intranet domain name to be unbound. intranetApplication The name of a vpn intranet application to be unbound. nextHopServer The name of the next hop server to be unbound globally. urlName The name of a vpn url to be unbound from vpn global. intranetIP The intranet ip address or range to be unbound. staServer Secure Ticketing Authority (STA) server to be removed, in the format 'http(s)://IP/FQDN/ URLPATH' Example Related Commands bind vpn global show vpn global
show vpn global

Synopsis show vpn global Description Display the vpn global bindings. Arguments summary fullValues format level stateflag policyName
The name of the policy. priority The priority of the policy. intranetDomain The conflicting intranet domain name. intranetApplication The intranet vpn application. nextHopServer The name of the next hop server bound to vpn global. urlName The intranet url. intranetIP The intranet ip address or range. netmask The intranet ip address or range's netmask. staServer Configured Secure Ticketing Authority (STA) server. staAuthID Authority ID of the STA Server. Authority ID is used to match incoming STA Tickets in the SOCKS/CGP protocol with the right STA Server. type Bindpoint to which the policy is bound policySubType count Example Related Commands bind vpn global unbind vpn global
set vpn parameter

Synopsis set vpn parameter [-httpPort <port> ...] [-winsIP <ip_addr>] [-dnsVserverName <string>] [-splitDns <splitDns>] [-sessTimeout <mins>] [-clientSecurity <expression> [-clientSecurityGroup <string>] [-clientSecurityMessage <string>]] [-clientSecurityLog ( ON | OFF )] [-splitTunnel <splitTunnel>] [-localLanAccess ( ON | OFF )] [rfc1918 ( ON | OFF )] [-spoofIIP ( ON | OFF )] [-killConnections ( ON | OFF )] [-transparentInterception ( ON | OFF )] [-defaultAuthorizationAction ( ALLOW | DENY )] [-authorizationGroup <string>] [-clientIdleTimeout <mins>] [-proxy <proxy>] [-allProtocolProxy <string> | -httpProxy <string> | -ftpProxy <string> | -socksProxy <string> | -gopherProxy <string> | -sslProxy <string>] [-proxyException <string>] [-proxyLocalBypass ( ENABLED | DISABLED )] [-clientCleanupPrompt ( ON | OFF )] [-forceCleanup <forceCleanup> ...] [clientOptions <clientOptions> ...] [-clientConfiguration <clientConfiguration> ...] [-SSO ( ON | OFF )] [-ssoCredential ( PRIMARY | SECONDARY )] [-windowsAutoLogon ( ON | OFF )] [-useMIP ( NS | OFF )] [-useIIP <useIIP>] [-clientDebug <clientDebug>] [-loginScript <input_filename>] [-logoutScript <input_filename>] [-homePage <URL>] [-icaProxy ( ON | OFF )] [-wihome <URL>] [-citrixReceiverHome
<URL>] [-wiPortalMode ( NORMAL | COMPACT )] [-ClientChoices ( ON | OFF )] [-iipDnsSuffix <string>] [-forcedTimeout <mins>] [-forcedTimeoutWarning <mins>] [-ntDomain <string>] [-clientlessVpnMode <clientlessVpnMode>] [-clientlessModeUrlEncoding <clientlessModeUrlEncoding>] [-clientlessPersistentCookie <clientlessPersistentCookie>] [-emailHome <URL>] [-allowedLoginGroups <string>] [-encryptCsecExp ( ENABLED | DISABLED )] [-appTokenTimeout <positive_integer>] Description Set global parameters for the SSL VPN feature. Arguments httpPort The SSL VPN HTTP port. Minimum value: 1 winsIP The WINS server IP address to be used for WINS host resolution by the VPN. dnsVserverName The configured DNS vserver to be used for DNS host resolution by the VPN. splitDns Set the VPN client to route the DNS requests to remote network or local network or both. Possible values: LOCAL, REMOTE, BOTH sessTimeout The session idle timeout value in minutes. This idle timeout meters the overall network inactivity for a session. Default value: 30 Minimum value: 1 clientSecurity The client security check string to be applied to client sessions. This is in the form of an Expression. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. clientSecurityLog Controls client side logging of security checks. Possible values: ON, OFF Default value: VPN_SESS_ACT_ON splitTunnel The split tunnel state, e.g. ON, OFF or REVERSE. Split Tunnelling ON enables the VPN client to route non-VPN traffic through its local network interface. When Split Tunnelling is OFF, no traffic may go to the local interface while the client session is active. Split tunneling can also be set to REVERSE. In this case all traffic directed to domains configured on the system will bypass the VPN tunnel. All other traffic is forced through the VPN tunnel. Possible values: ON, OFF, REVERSE Default value: VPN_SESS_ACT_OFF localLanAccess Finer grained local lan access. ON or OFF. splitTunnel, when OFF, permits no traffic to be routed to the client's local interface. But if, in addition, localLanAccess is turned ON, the client MAY route traffic to its local interface. This combination of switches is useful primarily when the rfc1918 switch is also specified. In this fashion, the client may restrict local lan access to devices which commonly have non-routable addresses, such as local printers or local file servers. Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF rfc1918 Only allow RFC1918 local addresses when local LAN access feature is enabled Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF spoofIIP The Spoof IP Address. Controls the Spoofing of Intranet IP to the Windows Applications by Windows VPN client when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. Possible values: ON, OFF Default value: ON
killConnections The state of kill connections. Determines whether Windows VPN client should kill all pre-existing connections (ie, the connections existing before the end user logged in to SSL VPN) and prevent new incoming connections on the Windows Client system when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF transparentInterception The transparent interception state, e.g. ON or OFF. Possible values: ON, OFF Default value: VPN_SESS_ACT_ON windowsClientType The Windows client type. Choose between two types of Windows Client\ a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed\ b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN Default value: VPN_SESS_ACT_CLT_AGENT defaultAuthorizationAction The authorization action state. Toggles the default authorization action to either ALLOW or DENY. Possible values: ALLOW, DENY authorizationGroup The authorization group to be applied to client sessions. clientIdleTimeout The client idle time out interval, which meters the client session's mouse and keyboard inactivity. The value is specified in minutes. Minimum value: 1 Maximum value: 9999 proxy The usage of proxy configuration. Possible values: BROWSER, NS, OFF allProtocolProxy The address to be used for all proxies. httpProxy The HTTP proxy IP address. ftpProxy The FTP proxy IP address. socksProxy The SOCKS proxy IP address. gopherProxy The Gopher proxy IP address. sslProxy The HTTPS proxy IP address. proxyException The Proxy Exception string that will be configured in the Browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser. proxyLocalBypass Bypass proxy server for local addresses option in IE proxy server settings will be enabled Possible values: ENABLED, DISABLED Default value: VPN_SESS_ACT_DISABLED clientCleanupPrompt The state for prompting for client clean up on session close. Possible values: ON, OFF Default value: VPN_SESS_ACT_ON
forceCleanup The client side items for force cleanup on session close. You may specify all or none alone or any combination of the client side items. clientOptions Configured buttons(and/or menu options in the docked client) in the Windows VPN client.\ Possible options \ none \ none of the Windows Client's buttons/menu options (except logout) are displayed. \ all \ all of the Windows Client's buttons/menu options are displayed. \ \ One or more of the following \ services \ only the "Services" button/menu option is displayed. \ filetransfer \ only the "File Transfer" button/menu option is displayed. \ configuration \ only the "Configuration" button/ menu option is displayed. clientConfiguration Configured tabs in the Windows VPN client. \ Options: \ none \ none of the Windows Client's tabs(except About) are displayed. \ all \ all of the Windows Client's tabs (except "Resptime") are displayed. \ \ One or more of the following \ general \ only the "General" tab is displayed. \ tunnel \ only the "Tunnel" tab is displayed. \ trace \ only the "Trace" tab is displayed. \ compression \ only the "Compression" tab is displayed. \ resptime \ only the "Resptime" tab is displayed. SSO Whether or not Single Sign-On is used Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On Possible values: PRIMARY, SECONDARY Default value: VPN_SESS_ACT_USE_PRIMARY_CREDENTIALS windowsAutoLogon Whether or not Windows Auto Logon is enabled Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF useMIP Whether or not a Mapped IP address is used Possible values: NS, OFF Default value: VPN_SESS_ACT_NS useIIP Controls how the intranet IP module is configured for usage. \ Options:\ SPILLOVER\ specifies that iip is ON and when we can't assign an intranet IP to an entity, which has other instances active, we spill over to using Mapped IP.\ NOSPILLOVER\ specifies that iip is ON and when we can't assign intranet IP to an entity, which has other instances active, then we initiate transfer login.\ OFFn specifies that intranet IP module won't be activated for this entity. Possible values: NOSPILLOVER, SPILLOVER, OFF Default value: VPN_SESS_ACT_NOSPILLOVER clientDebug The trace level on the Windows VPN Client.\ Options:\ debugn\ Detailed debug messages are collected are written into the specified file.\ stats\ Application audit level error messages and debug statistic counters are written into the specified file.\ events\ Application audit level error messages are written into the specified file.\ off\ Only critical events are logged into the Windows Application Log. Possible values: debug, stats, events, OFF Default value: VPN_FLAG_TRACE_OFF loginScript Login script path. logoutScript Logout script path. homePage The client home page. Setting this parameter overrides the serving of the default portal page with the URL specified here.
icaProxy Enable ICA proxy mode. This can be used to enable Secure Gateway functionality for the Web Interface. If enabled, a VPN homepage that points to a Web Interface in SG mode, has to be configured. Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF wihome Sets the home page of wi interface. Used only in conjunction with icaProxy ON. If clientChoices is ON, wiHome has to be configured. Since the end user is given a choice between FullClient and ICAProxy the homepage/landing page for each of these options could be different i.e. for FullClient it could be a Intranet web site and for the ICAProxy choice it will be a Web Interface web site. Hence we don't presume wihome == homepage. citrixReceiverHome Sets the home page of apprecvr interface. wiPortalMode WI layout on the VPN portal. Possible values: NORMAL, COMPACT ClientChoices Enables user to select different clients by displaying a set of options in a html page. The different client can be a) agent b) plugin c) wimode. Possible values: ON, OFF Default value: VPN_SESS_ACT_OFF epaClientType Choose between two types of End point Windows Client a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. Possible values: AGENT, PLUGIN iipDnsSuffix The IntranetIP DNS suffix. When a user logs into SSL-VPN, an A record is added to the DNS cache, after appending the configured IntranetIP DNS suffix to the username. forcedTimeout Maximum number of minutes a session is allowed to persist. Minimum value: 1 Maximum value: 255 forcedTimeoutWarning Number of minutes to warn a user before their session is removed by a forced time out. Minimum value: 1 Maximum value: 255 ntDomain NT domain to use with Smart Access when User Principle Name is not extracted from Active Directory clientlessVpnMode Whether clientlessVPN is available to the session. ON will make the session clientless and no client will be downloaded OFF will download the client but the clientlessVPN will also be available DISABLED will disable clientlessVPN altogether. Possible values: ON, OFF, DISABLED Default value: VPN_SESS_ACT_CVPNMODE_OFF clientlessModeUrlEncoding URL encoding to be used in clientless mode. No encoding will be done for TRANSPARENT. Protocol and domain will be encoded or encrypted with OPAQUE or ENCRYPT respectively. Possible values: TRANSPARENT, OPAQUE, ENCRYPT Default value: VPN_SESS_ACT_CVPN_ENC_OPAQUE clientlessPersistentCookie Controls the use of persistent cookie in clientless mode. ALLOW lets cookie to be stored on disk. DENY prevents usage of persistent cookie. PROMPT lets VPN user choose whether persistent
cookie should be used or not. Possible values: ALLOW, DENY, PROMPT Default value: VPN_SESS_ACT_CVPN_PERSCOOKIE_DENY emailHome Sets the EMail home for the portal allowedLoginGroups The groups allowed login to VPN encryptCsecExp Enable encryption of client security expressions. Possible values: ENABLED, DISABLED Default value: VPN_SESS_ACT_DISABLED appTokenTimeout The timeout value in seconds for tokens to access cloud gateway applications Default value: 100 Minimum value: 1 Maximum value: 255 Example set vpn parameter -httpport 80 90 -winsIP 192.168.0.220 -dnsVserverName mydns -sessTimeout 240 Related Commands unset vpn parameter show vpn parameter
unset vpn parameter

Synopsis unset vpn parameter [-httpPort] [-winsIP] [-dnsVserverName] [-splitDns] [-sessTimeout] [-clientSecurity] [clientSecurityGroup] [-clientSecurityMessage] [-clientSecurityLog] [-authorizationGroup] [-clientIdleTimeout] [-allProtocolProxy | -httpProxy | -ftpProxy | -socksProxy | -gopherProxy | -sslProxy] [-proxyException] [forceCleanup] [-clientOptions] [-clientConfiguration] [-loginScript] [-logoutScript] [-homePage] [-proxy] [wihome] [-citrixReceiverHome] [-wiPortalMode] [-iipDnsSuffix] [-forcedTimeout] [-forcedTimeoutWarning] [-defaultAuthorizationAction] [-ntDomain] [-clientlessVpnMode] [-emailHome] [-clientlessModeUrlEncoding] [-clientlessPersistentCookie] [-allowedLoginGroups] [-appTokenTimeout] [-splitTunnel] [-localLanAccess] [rfc1918] [-spoofIIP] [-killConnections] [-transparentInterception] [-proxyLocalBypass] [-clientCleanupPrompt] [SSO] [-ssoCredential] [-windowsAutoLogon] [-useMIP] [-useIIP] [-clientDebug] [-icaProxy] [-ClientChoices] [encryptCsecExp] Description Unset parameters for the SSL VPN feature..Refer to the set vpn parameter command for meanings of the arguments. Arguments Example Related Commands set vpn parameter show vpn parameter
show vpn parameter

Synopsis show vpn parameter
Description Display the configured vpn parameters. Arguments format level name The VPN name. httpPort The HTTP Port. winsIP The WINS server IP address used for WINS host resolution by the VPN. dnsVserverName The configured DNS vserver used for DNS host resolution by the VPN. splitDns The VPN client SplitDns state. sessTimeout The session timeout, in minutes. clientSecurity The client security check applied to client sessions. This is in the form of an Expression. Expressions are simple conditions, such as a test for equality, applied to operands, such as a URL string or an IP address. Expression syntax is described in the Installation and Configuration Guide. clientSecurityGroup The client security group that will be assigned on failure of the client security check. Users can in general be organized into Groups. In this case, the Client Security Group may have a more restrictive security policy. clientSecurityMessage The client security message that will be displayed on failure of the client security check. clientSecurityLog Controls client side logging of security checks. splitTunnel The split tunnel state, e.g. ON, OFF or REVERSE. Split Tunnelling ON enables the VPN client to route non-VPN traffic through its local network interface. When Split Tunnelling is OFF, no traffic may go to the local interface while the client session is active. Split tunneling can also be set to REVERSE. In this case all traffic directed to domains configured on the system will bypass the VPN tunnel. All other traffic is forced through the VPN tunnel. localLanAccess Finer grained local lan access. ON or OFF. splitTunnel, when OFF, permits no traffic to be routed to the client's local interface. But if, in addition, localLanAccess is turned ON, the client MAY route traffic to its local interface. This combination of switches is useful primarily when the rfc1918 switch is also specified. In this fashion, the client may restrict local lan access to devices which commonly have non-routable addresses, such as local printers or local file servers. rfc1918 Only allow RFC1918 local addresses when local LAN access feature is enabled. spoofIIP
Controls the Spoofing of Intranet IP to the Windows Applications by Windows VPN client when the end-user is connected to SSL VPN in '-splittunnel OFF' mode. killConnections Determines whether Windows VPN client should kill all pre-existing connections (ie, the connections existing before the end user logged in to SSL VPN) and prevent new incoming connections on the Windows Client system when the end-user is connected to SSL VPN in 'splittunnel OFF' mode. transparentInterception The transparent interception state, e.g. ON or OFF. windowsClientType The windows client type. defaultAuthorizationAction The Authentication Action, e.g. allow or deny. authorizationGroup The authorization group applied to the session. clientIdleTimeout The client idle timeout, in minutes. clientIdleTimeoutWarning The time after which the client gets a timeout warning, in minutes. proxy Proxy configuration for the session. allProtocolProxy Address set for all proxies. httpProxy The HTTP proxy IP address. ftpProxy The FTP proxy IP address. socksProxy The SOCKS proxy IP address. gopherProxy The Gopher proxy IP address. sslProxy The HTTPS proxy IP address. proxyException The Proxy Exception string that is configured in the Browser for bypassing the previously configured proxies. Allowed only if proxy type is Browser. proxyLocalBypass Bypass proxy server for local addresses option in IE proxy server settings will be enabled clientCleanupPrompt The state for prompting for client clean up on session close. forceCleanup Whether or not to force a cleanup on exit from the VPN session. clientOptions
List of configured buttons(and/or menu options in the docked client) in the Windows VPN client. clientConfiguration List of configured tabs in the Windows VPN client. SSO Enable or Disable Single Sign-On. ssoCredential The set of user credentials (primary or secondary) to use for Single Sign-On windowsAutoLogon Enable or Disable Windows Auto Logon. useMIP Enables or disables the use of a Mapped IP address for the session. useIIP Controls how the intranet IP module is configured for usage. \ Options:\ SPILLOVER\ specifies that iip is ON and when we can't assign an intranet IP to an entity, which has other instances active, we spill over to using Mapped IP.\ NOSPILLOVER\ specifies that iip is ON and when we can't assign intranet IP to an entity, which has other instances active, then we initiate transfer login.\ OFFn specifies that intranet IP module won't be activated for this entity. clientDebug Whether or not to add debugging information to the activity log on the client. loginScript Login script path. logoutScript Logout script path. homePage The home page URL, or 'none'. 'none' is case sensitive. icaProxy Enable ICA proxy mode. This can be used to enable Secure Gateway functionality for the Web Interface. If enabled, a VPN homepage that points to a Web Interface in SG mode, has to be configured. wihome Sets the home page of wi interface. Used only in conjunction with icaProxy ON. If clientChoices is ON, wiHome has to be configured. Since the end user is given a choice between FullClient and ICAProxy the homepage/landing page for each of these options could be different i.e. for FullClient it could be a Intranet web site and for the ICAProxy choice it will be a Web Interface web site. Hence we don't presume wihome == homepage. citrixReceiverHome Sets the home page of apprecvr interface. wiPortalMode WI layout on the VPN portal. ClientChoices Enables user to select different clients by displaying a set of options in a html page. The different client can be a) agent b) plugin c) wimode. epaClientType
Choose between two types of End point Windows Client a) Application Agent - which always runs in the task bar as a standalone application and also has a supporting service which runs permanently when installed b) Activex Control - ActiveX control run by Microsoft's Internet Explorer. iipDnsSuffix The DNS suffix for the intranet IP address. forcedTimeout The time, in minutes after which a timeout is forced. forcedTimeoutWarning The time, in minutes, after which a timeout warning is issued. ntDomain NT domain to use with Smart Access when User Principle Name is not extracted from Active Directory clientlessVpnMode Whether clientlessVPN is available to the session. clientlessModeUrlEncoding URL encoding to be used for clientless mode. clientlessPersistentCookie Controls the use of persistent cookie in clientless mode. ALLOW lets cookie to be stored on disk. DENY prevents usage of persistent cookie. PROMPT lets VPN user choose whether persistent cookie should be used or not. emailHome Sets the EMail home for the portal allowedLoginGroups The groups allowed login to VPN encryptCsecExp Enable encryption of client security expressions. appTokenTimeout The timeout value in seconds for tokens to access cloud gateway applications Example
Related Commands set vpn parameter unset vpn parameter
Chapter
45
Wi Commands
Topics: add wi site rm wi site set wi site bind wi site unbind wi site show wi site install wi package uninstall wi package
1370 | Citrix NetScaler 10 | Wi Commands
add wi site
Synopsis add wi site <sitePath> [<agURL> [<staURL> [-secondSTAURL <string> [-useTwoTickets ( ON | OFF )]] [-sessionReliability ( ON | OFF )]] [-authenticationPoint ( WebInterface | AccessGateway )]] [wiAuthenticationMethods ( Explicit | Anonymous ) ...] [-defaultCustomTextLocale <defaultCustomTextLocale>] [-webSessionTimeout <positive_integer>] [-defaultAccessMethod <defaultAccessMethod>] [-loginTitle <string>] [-siteType ( XenAppWeb | XenAppServices )] [-publishedResourceType <publishedResourceType>] [-kioskMode ( ON | OFF )] Description Add a new Web Interface site for XenApp Arguments sitePath The path of Web Interface site agURL The URL of Access Gateway wiAuthenticationMethods The method of authentication to be used at Web Interface Default value: WI_EXPLICIT defaultCustomTextLocale Choice of language Possible values: German, English, Spanish, French, Japanese, Korean, Russian, Chinese_simplified, Chinese_traditional Default value: LANG_EN webSessionTimeout Specifies the time-out value in minutes for idle Web browser sessions Default value: 20 Minimum value: 1 Maximum value: 1440 defaultAccessMethod The default value of secure access method, which will be Direct in absence of agURL or GatewayDirect otherwise Possible values: Direct, Alternate, Translated, GatewayDirect, GatewayAlternate, GatewayTranslated loginTitle Title to be displayed on Login page Default value: "Welcome to Web Interface on NetScaler" siteType The type of site, whether site provides access through Web browser or XenApp Plugin Possible values: XenAppWeb, XenAppServices Default value: WI_XENAPPWEB publishedResourceType The method to access the published XenApp resources Possible values: Online, Offline, DualMode Default value: WI_ONLINE kioskMode Enables Kiosk Mode (discard user customizations) Possible values: ON, OFF Default value: OFF Example add wi site /Citrix/PNAgent -siteType XenAppServices Related Commands rm wi site set wi site
Citrix NetScaler 10 | Wi Commands | 1371
bind wi site unbind wi site show wi site
rm wi site
Synopsis rm wi site <sitePath> Description Remove existing Web Interface site for XenApp Arguments sitePath The path of Web Interface site Example rm wi site /Citrix/PNAgent Related Commands add wi site set wi site bind wi site unbind wi site show wi site
set wi site
Synopsis set wi site <sitePath> [-agURL <string>] [-staURL <string>] [-sessionReliability ( ON | OFF )] [-useTwoTickets ( ON | OFF )] [-secondSTAURL <string>] [-wiAuthenticationMethods ( Explicit | Anonymous ) ...] [defaultAccessMethod <defaultAccessMethod>] [-defaultCustomTextLocale <defaultCustomTextLocale>] [-webSessionTimeout <positive_integer>] [-loginTitle <string>] [-authenticationPoint ( WebInterface | AccessGateway )] [-publishedResourceType <publishedResourceType>] [-kioskMode ( ON | OFF )] Description Modify a Web Interface site for XenApp Arguments sitePath The path of Web Interface site agURL The URL of Access Gateway staURL The URL of Secure Ticket Authortity server sessionReliability Enables session reliability Possible values: ON, OFF Default value: OFF useTwoTickets
Request tickets from two STA Servers, if available Possible values: ON, OFF Default value: OFF secondSTAURL The URL of the second Secure Ticket Authortity server wiAuthenticationMethods The method of authentication to be used at Web Interface Default value: WI_EXPLICIT defaultAccessMethod The default value of secure access method, which will be Direct in absence of agURL or GatewayDirect otherwise Possible values: Direct, Alternate, Translated, GatewayDirect, GatewayAlternate, GatewayTranslated defaultCustomTextLocale Choice of language Possible values: German, English, Spanish, French, Japanese, Korean, Russian, Chinese_simplified, Chinese_traditional Default value: LANG_EN webSessionTimeout Specifies the time-out value in minutes for idle Web browser sessions Default value: 20 Minimum value: 1 Maximum value: 1440 loginTitle Title to be displayed on Login page Default value: "Welcome to Web Interface on NetScaler" authenticationPoint The authentication point to be used for the site Possible values: WebInterface, AccessGateway publishedResourceType The method to access the published XenApp resources Possible values: Online, Offline, DualMode Default value: WI_ONLINE kioskMode Enables Kiosk Mode (discard user customizations) Possible values: ON, OFF Default value: OFF Example set wi site /Citrix/PNAgent -staURL http://myStaServer Related Commands add wi site rm wi site bind wi site unbind wi site show wi site
bind wi site
Synopsis bind wi site <sitePath> ((<farmName> <xmlServerAddresses> [-xmlPort <positive_integer>] [-transport <transport> [-sslRelayPort <positive_integer>]] [-loadBalance ( ON | OFF )]) | ((-accessMethod <accessMethod> (clientIpAddress <ip_addr> -clientNetMask <netmask>)) | (-translationInternalIp <ip_addr> -translationInternalPort <port|*> -translationExternalIp <ip_addr> -translationExternalPort <port|*> [-accessType <accessType>]))) Description Add a new XenApp Farm to the Web Interface site for XenApp
Arguments sitePath The path of Web Interface site farmName The name of XenApp Farm accessMethod secure access method to be applied for client ip range Possible values: Direct, Alternate, Translated, GatewayDirect, GatewayAlternate, GatewayTranslated translationInternalIp Internal Ip Address to be tranlated from Example bind wi site /Citrix/XenApp Farm2 10.10.10.11 Related Commands add wi site rm wi site set wi site unbind wi site show wi site
unbind wi site
Synopsis unbind wi site <sitePath> (<farmName> | ((-clientIpAddress <ip_addr> -clientNetMask <netmask>) | (-translationInternalIp <ip_addr> -translationInternalPort <port|*> -translationExternalIp <ip_addr> translationExternalPort <port|*>))) Description Remove existing XenApp Farm from Web Interface site Arguments sitePath The path of Web Interface site farmName The name of XenApp Farm clientIpAddress Client's Ip Address translationInternalIp Internal Ip Address to be tranlated from Example unbind wi site /Citrix/XenApp Farm2 Related Commands add wi site
rm wi site set wi site bind wi site show wi site
show wi site
Synopsis show wi site [<sitePath>] Description Display existing Web Interface sites for XenApp Arguments sitePath The path of Web Interface site format level stateflag agURL The URL of Access Gateway staURL The URL of Secure Ticketing Authortity server wiAuthenticationMethods The method of authentication to be used at Web Interface loginTitle Title to be displayed on Login page defaultCustomTextLocale Choice of language webSessionTimeout Specifies the time-out value in minutes for idle Web browser sessions siteType The type of site, whether site provides access through Web browser or XenApp Plugin publishedResourceType The method to access the published XenApp resources defaultAccessMethod The default value of secure access method, which will be Direct in absence of agURL or GatewayDirect otherwise farmName The name of XenApp Farm accessMethod secure access method to be applied for client ip range clientIpAddress Client's Ip Address
clientNetMask client NetMask translationInternalIp Internal Ip Address to be tranlated from translationInternalPort Internal Port to be translated from translationExternalIp External Ip Address to be translated to translationExternalPort External Port to be translated to accessType Access Type xmlServerAddresses Comma separated list of host names or IP addresses of server(s) running XML service xmlPort The port to be used for contacting XML server transport The type of transport to be used for XML service sslRelayPort The port to be used for SSL Relay sessionReliability Enables session reliability useTwoTickets Request tickets from two STA Servers, if available secondSTAURL The URL of the second Secure Ticket Authortity server loadBalance Specifies whether to use all the XML servers or only one in failover mode authenticationPoint The authentication point to be used for the site kioskMode Enables Kiosk Mode (discard user customizations) count Example show wi site
Related Commands add wi site rm wi site set wi site bind wi site
unbind wi site
install wi package
Synopsis install wi package [-jre <URL>] [-wi <URL>] [-maxSites <maxSites>] Description Install Web Interface for XenApp. Arguments jre The location from where to get the java runtime package. The runtime can be downloaded from http://www.freebsdfoundation.org/cgi-bin/download?download=diablojdk-freebsd6.amd64.1.6.0.07.02.tbz Default value: "file://tmp/diablo-jdkfreebsd6.amd64.1.6.0.07.02.tbz" wi The location from where to get the web interface package. Default value: "http://citrix.com/ downloads/nswi-1.3.tgz" maxSites Maximum number of WI sites that can be created; changes the amount of RAM reserved for WI usage; changing its value results in restart of Tomcat & invalidates any existing WI session Possible values: 3, 25, 50, 100, 200, 500 Example install wi package -jre http://10.102.1.10/diablo-latte-freebsd6-amd64-1.6.0_07-b02.tar.bz2 -wi http://citrix.com/downloads/nswi-1.3.tgz -maxSites 25
Related Commands uninstall wi package
uninstall wi package
Synopsis uninstall wi package Description Remove the Web Interface for XenApp and all its configuration Arguments Example uninstall wi package
Related Commands install wi package

NS CommandReference Guide

Enviado por

Dados do documento

Direitos autorais

Formatos disponíveis

Compartilhar este documento

Compartilhar ou incorporar documento

Opções de compartilhamento

Você considera este documento útil?

Este conteúdo é inapropriado?

Direitos autorais:

Formatos disponíveis

NS CommandReference Guide

Enviado por

Direitos autorais:

Formatos disponíveis

Citrix NetScaler 10 Citrix NetScaler Command Reference Guide

2 | Citrix NetScaler 10 | Introduction

4 | Citrix NetScaler 10 | Copyright and Trademark Notice

Citrix NetScaler 10 | TOC | 5

Chapter 1: Introduction - Classic CLI.........................................................39

Chapter 2: Introduction - Contextual CLI..................................................49

Chapter 3: AAA Commands.........................................................................61

6 | Citrix NetScaler 10 | TOC

Chapter 4: APP Commands.........................................................................93

Chapter 5: AppFlow Commands.................................................................95

Chapter 6: Application Firewall Commands........................................... 117

Citrix NetScaler 10 | TOC | 7

8 | Citrix NetScaler 10 | TOC

Chapter 7: Auditing Commands............................................................... 191

Citrix NetScaler 10 | TOC | 9

Chapter 8: Authentication Commands......................................................217

10 | Citrix NetScaler 10 | TOC

Chapter 9: Authorization Commands...................................................... 265

Chapter 10: Base Commands.................................................................... 275

Citrix NetScaler 10 | TOC | 11

Chapter 11: Integrated Caching Commands........................................... 339

12 | Citrix NetScaler 10 | TOC

Chapter 12: CLI Commands..................................................................... 381

Chapter 13: Cluster Commands................................................................391

Citrix NetScaler 10 | TOC | 13

Chapter 14: Compression Commands...................................................... 403

Chapter 15: Cache Redirection Commands.............................................427

Chapter 16: Content Switching Commands.............................................447

14 | Citrix NetScaler 10 | TOC

Chapter 17: DNS Commands.................................................................... 473

Citrix NetScaler 10 | TOC | 15

Chapter 18: DataStream commands.........................................................533

16 | Citrix NetScaler 10 | TOC

Chapter 19: DoS Commands..................................................................... 537

Chapter 20: Filter Commands...................................................................545

Chapter 21: Gslb Commands.................................................................... 563

Citrix NetScaler 10 | TOC | 17

Chapter 22: Ha Commands....................................................................... 607

Chapter 23: Ha Commands....................................................................... 617

18 | Citrix NetScaler 10 | TOC

Chapter 24: Ipsec Commands....................................................................627

Chapter 25: Lb Commands........................................................................633

Citrix NetScaler 10 | TOC | 19

Chapter 26: Network commands...............................................................699

20 | Citrix NetScaler 10 | TOC

Citrix NetScaler 10 | TOC | 21

Chapter 27: Ns Commands........................................................................ 813

22 | Citrix NetScaler 10 | TOC

Citrix NetScaler 10 | TOC | 23

24 | Citrix NetScaler 10 | TOC

Citrix NetScaler 10 | TOC | 25

Chapter 28: Ntp Commands...................................................................... 965

Chapter 29: Policy Commands.................................................................. 973

26 | Citrix NetScaler 10 | TOC

Chapter 30: Pq Commands........................................................................997

Chapter 31: Protocol Commands............................................................ 1005

Chapter 32: Responder Commands........................................................ 1025

Citrix NetScaler 10 | TOC | 27

update responder htmlpage.................................................................................................................1044 show responder htmlpage...................................................................................................................1045

Chapter 33: Rewrite Commands.............................................................1047

Chapter 34: Router Commands.............................................................. 1069

Chapter 35: Sc Commands...................................................................... 1079

28 | Citrix NetScaler 10 | TOC

Chapter 36: Snmp Commands................................................................ 1089