ADC CLI Commands

lsn-group

The following operations can be performed on “lsn-group”:

bind set unset stat unbind show add rm

bind lsn group

Bind LSN Group with protocol profiles and pools.

Synopsis

bind lsn group (-poolname | -transportprofilename | -ipsecAlgProfile | -httphdrlogprofilename | -appsprofilename | -sipalgprofilename | -rtspalgprofilename | -pcpServer | -logProfileName )

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

poolname Name of the LSN pool to bind to the specified LSN group. Only LSN Pools and LSN groups with the same NAT type settings can be bound together. Multiples LSN pools can be bound to an LSN group.

For Deterministic NAT, pools bound to an LSN group cannot be bound to other LSN groups. For Dynamic NAT, pools bound to an LSN group can be bound to multiple LSN groups.

transportprofilename Name of the LSN transport profile to bind to the specified LSN group. Bind a profile for each protocol for which you want to specify settings.

By default, one LSN transport profile with default settings for TCP, UDP, and ICMP protocols is bound to an LSN group during its creation. This profile is called a default transport.

An LSN transport profile that you bind to an LSN group overrides the default LSN transport profile for that protocol.

ipsecAlgProfile Name of the IPSec ALG profile to bind to the specified LSN group.

httphdrlogprofilename The name of the LSN HTTP header logging Profile.

appsprofilename Name of the LSN application profile to bind to the specified LSN group. For each set of destination ports, bind a profile for each protocol for which you want to specify settings.

By default, one LSN application profile with default settings for TCP, UDP, and ICMP protocols for all destination ports is bound to an LSN group during its creation. This profile is called a default application profile.

When you bind an LSN application profile, with a specified set of destination ports, to an LSN group, the bound profile overrides the default LSN application profile for that protocol at that set of destination ports.

sipalgprofilename The name of the LSN SIP ALG Profile.

rtspalgprofilename The name of the LSN RTSP ALG Profile.

pcpServer Name of the PCP server to be associated with lsn group.

logProfileName The name of the LSN logging Profile.

Example

bind lsn group group1 -transportprofile profile1 -appsprofile profile2

set lsn group

Set LSN Group.

Synopsis

set lsn group [-portblocksize ] [-logging ( ENABLED | DISABLED )] [-sessionLogging ( ENABLED | DISABLED )] [-sessionSync ( ENABLED | DISABLED )] [-snmptraplimit ] [-ftp ( ENABLED | DISABLED )] [-pptp ( ENABLED | DISABLED )] [-sipalg ( ENABLED | DISABLED )] [-rtspalg ( ENABLED | DISABLED )] [-ftpcm ( ENABLED | DISABLED )]

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

portblocksize Size of the NAT port block to be allocated for each subscriber.

To set this parameter for Dynamic NAT, you must enable the port block allocation parameter in the bound LSN pool. For Deterministic NAT, the port block allocation parameter is always enabled, and you cannot disable it.

In Dynamic NAT, the Citrix ADC allocates a random NAT port block, from the available NAT port pool of an NAT IP address, for each subscriber. For a subscriber, if all the ports are allocated from the subscriber’s allocated port block, the ADC allocates a new random port block for the subscriber.

The default port block size is 256 for Deterministic NAT, and 0 for Dynamic NAT. Default value: 0 Minimum value: 256 Maximum value: 65536

logging Log mapping entries and sessions created or deleted for this LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

The ADC uses its existing syslog and audit log framework to log LSN information. You must enable global level LSN logging by enabling the LSN parameter in the related NSLOG action and SYLOG action entities. When the Logging parameter is enabled, the Citrix ADC generates log messages related to LSN mappings and LSN sessions of this LSN group. The ADC then sends these log messages to servers associated with the NSLOG action and SYSLOG actions entities.

A log message for an LSN mapping entry consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN mapping entry is created or deleted
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID might be present, depending on the following conditions: ` Destination IP address and port are not logged for Endpoint-Independent mapping ` Only Destination IP address (and not port) is logged for Address-Dependent mapping ` Destination IP address and port are logged for Address-Port-Dependent mapping

Possible values: ENABLED, DISABLED Default value: DISABLED

sessionLogging Log sessions created or deleted for the LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

A log message for an LSN session consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN session is created or removed
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID

Possible values: ENABLED, DISABLED Default value: DISABLED

sessionSync In a high availability (HA) deployment, synchronize information of all LSN sessions related to this LSN group with the secondary node. After a failover, established TCP connections and UDP packet flows are kept active and resumed on the secondary node (new primary).

For this setting to work, you must enable the global session synchronization parameter.

Possible values: ENABLED, DISABLED Default value: ENABLED

snmptraplimit Maximum number of SNMP Trap messages that can be generated for the LSN group in one minute. Default value: 100 Minimum value: 0 Maximum value: 10000

ftp Enable Application Layer Gateway (ALG) for the FTP protocol. For some application-layer protocols, the IP addresses and protocol port numbers are usually communicated in the packet’s payload. When acting as an ALG, the Citrix ADC changes the packet’s payload to ensure that the protocol continues to work over LSN.

Note: The Citrix ADC also includes ALG for ICMP and TFTP protocols. ALG for the ICMP protocol is enabled by default, and there is no provision to disable it. ALG for the TFTP protocol is disabled by default. ALG is enabled automatically for an LSN group when you bind a UDP LSN application profile, with endpoint-independent-mapping, endpoint-independent filtering, and destination port as 69 (well-known port for TFTP), to the LSN group.

Possible values: ENABLED, DISABLED Default value: ENABLED

pptp Enable the PPTP Application Layer Gateway.

Possible values: ENABLED, DISABLED Default value: DISABLED

sipalg Enable the SIP ALG.

Possible values: ENABLED, DISABLED Default value: DISABLED

rtspalg Enable the RTSP ALG.

Possible values: ENABLED, DISABLED Default value: DISABLED

ftpcm Enable the FTP connection mirroring for specified LSN group. Connection mirroring (CM or connection failover) refers to keeping active an established TCP or UDP connection when a failover occurs.

Possible values: ENABLED, DISABLED Default value: DISABLED

Example

set lsn group group1

unset lsn group

Use this command to remove lsn group settings.Refer to the set lsn group command for meanings of the arguments.

Synopsis

unset lsn group [-portblocksize] [-logging] [-sessionLogging] [-sessionSync] [-snmptraplimit] [-ftp] [-pptp] [-sipalg] [-rtspalg] [-ftpcm]

stat lsn group

Display statistics for all LSN groups or display detailed statistics for the specified LSN group.

Synopsis

stat lsn group [] [-detail] [-fullValues] [-ntimes ] [-logFile ] [-clearstats ( basic | full )]

Arguments

groupname Name of the LSN Group.

detail Specifies detailed output (including more statistics). The output can be quite voluminous. Without this argument, the output will show only a summary.

fullValues Specifies that numbers and strings should be displayed in their full form. Without this option, long strings are shortened and large numbers are abbreviated

ntimes The number of times, in intervals of seven seconds, the statistics should be displayed. Default value: 1 Minimum value: 0

logFile The name of the log file to be used as input.

clearstats Clear the statsistics / counters

Possible values: basic, full

Output

count devno stateflag

Counters

Current Sessions (Session) Number of Current Sessions for LSN group

Translated Bytes (Bytes) Number of Translated Bytes for LSN group

Translated Pkts (Pkts) Number of Translated Pkts for LSN group

TCP Translated Pkts (TcpTranslPkts) Number of TCP Translated Pkts for LSN group

TCP Translated Bytes (TcpTranslBytes) Number of TCP Translated Bytes for LSN group

TCP Dropped Pkts (TcpDrpPkts) Number of TCP Dropped Pkts for LSN group

TCP Current Sessions (TcpSess) Number of TCP Current Sessions for LSN group

UDP Translated Pkts (UdpTranslPkts) Number of UDP Translated Pkts for LSN group

UDP Translated Bytes (UdpTranslBytes) Number of UDP Translated Bytes for LSN group

UDP Dropped Pkts (UdpDrpPkts) Number of UDP Dropped Pkts for LSN group

UDP Current Sessions (UdpSess) Number of UDP Current Sessions for LSN group

ICMP Translated Pkts (IcmpTranslPkts) Number of ICMP Translated Pkts for LSN group

ICMP Translated Bytes (IcmpTranslBytes) Number of ICMP Translated Bytes for LSN group

ICMP Dropped Pkts (IcmpDrpPkts) Number of ICMP Dropped Pkts for LSN group

ICMP Current Sessions (IcmpSess) Number of ICMP Current Sessions for LSN group

Current Subscribers (Subscr) Number of ICMP Current Sessions for LSN group

unbind lsn group

Unbind LSN Group with protocol profiles and pools.

Synopsis

unbind lsn group (-poolname | -transportprofilename | -ipsecAlgProfile | -httphdrlogprofilename | -appsprofilename | -sipalgprofilename | -rtspalgprofilename | -pcpServer | -logProfileName )

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

poolname Name of the LSN pool to bind to the specified LSN group. Only LSN Pools and LSN groups with the same NAT type settings can be bound together. Multiples LSN pools can be bound to an LSN group.

For Deterministic NAT, pools bound to an LSN group cannot be bound to other LSN groups. For Dynamic NAT, pools bound to an LSN group can be bound to multiple LSN groups.

transportprofilename Name of the LSN transport profile to bind to the specified LSN group. Bind a profile for each protocol for which you want to specify settings.

By default, one LSN transport profile with default settings for TCP, UDP, and ICMP protocols is bound to an LSN group during its creation. This profile is called a default transport.

An LSN transport profile that you bind to an LSN group overrides the default LSN transport profile for that protocol.

ipsecAlgProfile Name of the IPSec ALG profile to bind to the specified LSN group.

httphdrlogprofilename The name of the LSN HTTP header logging Profile.

appsprofilename Name of the LSN application profile to bind to the specified LSN group. For each set of destination ports, bind a profile for each protocol for which you want to specify settings.

By default, one LSN application profile with default settings for TCP, UDP, and ICMP protocols for all destination ports is bound to an LSN group during its creation. This profile is called a default application profile.

When you bind an LSN application profile, with a specified set of destination ports, to an LSN group, the bound profile overrides the default LSN application profile for that protocol at that set of destination ports.

sipalgprofilename The name of the LSN SIP ALG Profile.

rtspalgprofilename The name of the LSN RTSP ALG Profile.

pcpServer Name of the PCP server to be associated with lsn group.

logProfileName The name of the LSN logging Profile.

Example

unbind lsn group group1 -transportprofile profile1 -appsprofile profile2

show lsn group

Display LSN Group.

Synopsis

show lsn group []

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

Output

poolname Name of the LSN pool to bind to the specified LSN group. Only LSN Pools and LSN groups with the same NAT type settings can be bound together. Multiples LSN pools can be bound to an LSN group.

For Deterministic NAT, pools bound to an LSN group cannot be bound to other LSN groups. For Dynamic NAT, pools bound to an LSN group can be bound to multiple LSN groups.

transportprofilename Name of the LSN transport profile to bind to the specified LSN group. Bind a profile for each protocol for which you want to specify settings.

By default, one LSN transport profile with default settings for TCP, UDP, and ICMP protocols is bound to an LSN group during its creation. This profile is called a default transport.

An LSN transport profile that you bind to an LSN group overrides the default LSN transport profile for that protocol.

appsprofilename Name of the LSN application profile to bind to the specified LSN group. For each set of destination ports, bind a profile for each protocol for which you want to specify settings.

By default, one LSN application profile with default settings for TCP, UDP, and ICMP protocols for all destination ports is bound to an LSN group during its creation. This profile is called a default application profile.

When you bind an LSN application profile, with a specified set of destination ports, to an LSN group, the bound profile overrides the default LSN application profile for that protocol at that set of destination ports.

clientname Name of the LSN client entity to be associated with the LSN group. You can associate only one LSN client entity with an LSN group.You cannot remove this association or replace with another LSN client entity once the LSN group is created.

nattype Type of NAT IP address and port allocation (from the bound LSN pools) for subscribers:

Available options function as follows:

  • Deterministic - Allocate a NAT IP address and a block of ports to each subscriber (of the LSN client bound to the LSN group). The Citrix ADC sequentially allocates NAT resources to these subscribers. The Citrix ADC ADC assigns the first block of ports (block size determined by the port block size parameter of the LSN group) on the beginning NAT IP address to the beginning subscriber IP address. The next range of ports is assigned to the next subscriber, and so on, until the NAT address does not have enough ports for the next subscriber. In this case, the first port block on the next NAT address is used for the subscriber, and so on. Because each subscriber now receives a deterministic NAT IP address and a block of ports, a subscriber can be identified without any need for logging. For a connection, a subscriber can be identified based only on the NAT IP address and port, and the destination IP address and port. The maximum number of LSN subscribers allowed, globally, is 1 million.

  • Dynamic - Allocate a random NAT IP address and a port from the LSN NAT pool for a subscriber’s connection. If port block allocation is enabled (in LSN pool) and a port block size is specified (in the LSN group), the Citrix ADC allocates a random NAT IP address and a block of ports for a subscriber when it initiates a connection for the first time. The ADC allocates this NAT IP address and a port (from the allocated block of ports) for different connections from this subscriber. If all the ports are allocated (for different subscriber’s connections) from the subscriber’s allocated port block, the ADC allocates a new random port block for the subscriber.

allocPolicy NAT IP and PORT block allocation policy for Deterministic NAT. Supported Policies are, 1: PORTS: Port blocks from single NATIP will be allocated to LSN subscribers sequentially. After all blocks are exhausted, port blocks from next NATIP will be allocated and so on. 2: IPADDRS(Default): One port block from each NATIP will be allocated and once all the NATIPs are over second port block from each NATIP will be allocated and so on. To understand better if we assume port blocks of all NAT IPs as two dimensional array, PORTS policy follows “row major order” and IPADDRS policy follows “column major order” while allocating port blocks. Example: Client IPs: 2.2.2.1, 2.2.2.2 and 2.2.2.3 NAT IPs and PORT Blocks: 4.4.4.1:PB1, PB2, PB3,., PBn 4.4.4.2: PB1, PB2, PB3,., PBn PORTS Policy: 2.2.2.1 => 4.4.4.1:PB1 2.2.2.2 => 4.4.4.1:PB2 2.2.2.3 => 4.4.4.1:PB3 IPADDRS Policy: 2.2.2.1 => 4.4.4.1:PB1 2.2.2.2 => 4.4.4.2:PB1 2.2.2.3 => 4.4.4.1:PB2

portblocksize Size of the NAT port block to be allocated for each subscriber.

To set this parameter for Dynamic NAT, you must enable the port block allocation parameter in the bound LSN pool. For Deterministic NAT, the port block allocation parameter is always enabled, and you cannot disable it.

In Dynamic NAT, the Citrix ADC allocates a random NAT port block, from the available NAT port pool of an NAT IP address, for each subscriber. For a subscriber, if all the ports are allocated from the subscriber’s allocated port block, the ADC allocates a new random port block for the subscriber.

The default port block size is 256 for Deterministic NAT, and 0 for Dynamic NAT.

logging Log mapping entries and sessions created or deleted for this LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

The ADC uses its existing syslog and audit log framework to log LSN information. You must enable global level LSN logging by enabling the LSN parameter in the related NSLOG action and SYLOG action entities. When the Logging parameter is enabled, the Citrix ADC generates log messages related to LSN mappings and LSN sessions of this LSN group. The ADC then sends these log messages to servers associated with the NSLOG action and SYSLOG actions entities.

A log message for an LSN mapping entry consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN mapping entry is created or deleted
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID might be present, depending on the following conditions: ` Destination IP address and port are not logged for Endpoint-Independent mapping ` Only Destination IP address (and not port) is logged for Address-Dependent mapping ` Destination IP address and port are logged for Address-Port-Dependent mapping

sessionLogging Log sessions created or deleted for the LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

A log message for an LSN session consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN session is created or removed
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID

sessionSync In a high availability (HA) deployment, synchronize information of all LSN sessions related to this LSN group with the secondary node. After a failover, established TCP connections and UDP packet flows are kept active and resumed on the secondary node (new primary).

For this setting to work, you must enable the global session synchronization parameter.

snmptraplimit Maximum number of SNMP Trap messages that can be generated for the LSN group in one minute.

ftp Enable Application Layer Gateway (ALG) for the FTP protocol. For some application-layer protocols, the IP addresses and protocol port numbers are usually communicated in the packet’s payload. When acting as an ALG, the Citrix ADC changes the packet’s payload to ensure that the protocol continues to work over LSN.

Note: The Citrix ADC also includes ALG for ICMP and TFTP protocols. ALG for the ICMP protocol is enabled by default, and there is no provision to disable it. ALG for the TFTP protocol is disabled by default. ALG is enabled automatically for an LSN group when you bind a UDP LSN application profile, with endpoint-independent-mapping, endpoint-independent filtering, and destination port as 69 (well-known port for TFTP), to the LSN group.

pptp Enable the PPTP Application Layer Gateway.

groupId sipalg Enable the SIP ALG.

sipalgprofilename The name of the LSN SIP ALG Profile.

rtspalg Enable the RTSP ALG.

rtspalgprofilename The name of the LSN RTSP ALG Profile.

ip6profile Name of the LSN ip6 profile to associate with the specified LSN group. An ip6 profile can be associated with a group only during group creation.

By default, no LSN ip6 profile is associated with an LSN group during its creation. Only one ip6profile can be associated with a group.

httphdrlogprofilename The name of the LSN HTTP header logging Profile.

pcpServer Name of the PCP server to be associated with lsn group.

logProfileName The name of the LSN logging Profile.

ipsecAlgProfile Name of the IPSec ALG profile to bind to the specified LSN group.

ftpcm Enable the FTP connection mirroring for specified LSN group. Connection mirroring (CM or connection failover) refers to keeping active an established TCP or UDP connection when a failover occurs.

devno count stateflag

Example

show lsn group group1

add lsn group

Add LSN Group.

Synopsis

add lsn group -clientname [-nattype ( DYNAMIC | DETERMINISTIC ) [-allocPolicy ( PORTS | IPADDRS )]] [-portblocksize ] [-logging ( ENABLED | DISABLED )] [-sessionLogging ( ENABLED | DISABLED )] [-sessionSync ( ENABLED | DISABLED )] [-snmptraplimit ] [-ftp ( ENABLED | DISABLED )] [-pptp ( ENABLED | DISABLED )] [-sipalg ( ENABLED | DISABLED )] [-rtspalg ( ENABLED | DISABLED )] [-ip6profile ] [-ftpcm ( ENABLED | DISABLED )]

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

clientname Name of the LSN client entity to be associated with the LSN group. You can associate only one LSN client entity with an LSN group.You cannot remove this association or replace with another LSN client entity once the LSN group is created.

nattype Type of NAT IP address and port allocation (from the bound LSN pools) for subscribers:

Available options function as follows:

  • Deterministic - Allocate a NAT IP address and a block of ports to each subscriber (of the LSN client bound to the LSN group). The Citrix ADC sequentially allocates NAT resources to these subscribers. The Citrix ADC ADC assigns the first block of ports (block size determined by the port block size parameter of the LSN group) on the beginning NAT IP address to the beginning subscriber IP address. The next range of ports is assigned to the next subscriber, and so on, until the NAT address does not have enough ports for the next subscriber. In this case, the first port block on the next NAT address is used for the subscriber, and so on. Because each subscriber now receives a deterministic NAT IP address and a block of ports, a subscriber can be identified without any need for logging. For a connection, a subscriber can be identified based only on the NAT IP address and port, and the destination IP address and port. The maximum number of LSN subscribers allowed, globally, is 1 million.

  • Dynamic - Allocate a random NAT IP address and a port from the LSN NAT pool for a subscriber’s connection. If port block allocation is enabled (in LSN pool) and a port block size is specified (in the LSN group), the Citrix ADC allocates a random NAT IP address and a block of ports for a subscriber when it initiates a connection for the first time. The ADC allocates this NAT IP address and a port (from the allocated block of ports) for different connections from this subscriber. If all the ports are allocated (for different subscriber’s connections) from the subscriber’s allocated port block, the ADC allocates a new random port block for the subscriber.

Possible values: DYNAMIC, DETERMINISTIC Default value: DYNAMIC

allocPolicy NAT IP and PORT block allocation policy for Deterministic NAT. Supported Policies are, 1: PORTS: Port blocks from single NATIP will be allocated to LSN subscribers sequentially. After all blocks are exhausted, port blocks from next NATIP will be allocated and so on. 2: IPADDRS(Default): One port block from each NATIP will be allocated and once all the NATIPs are over second port block from each NATIP will be allocated and so on. To understand better if we assume port blocks of all NAT IPs as two dimensional array, PORTS policy follows “row major order” and IPADDRS policy follows “column major order” while allocating port blocks. Example: Client IPs: 2.2.2.1, 2.2.2.2 and 2.2.2.3 NAT IPs and PORT Blocks: 4.4.4.1:PB1, PB2, PB3,., PBn 4.4.4.2: PB1, PB2, PB3,., PBn PORTS Policy: 2.2.2.1 => 4.4.4.1:PB1 2.2.2.2 => 4.4.4.1:PB2 2.2.2.3 => 4.4.4.1:PB3 IPADDRS Policy: 2.2.2.1 => 4.4.4.1:PB1 2.2.2.2 => 4.4.4.2:PB1 2.2.2.3 => 4.4.4.1:PB2

Possible values: PORTS, IPADDRS Default value: PORTS

portblocksize Size of the NAT port block to be allocated for each subscriber.

To set this parameter for Dynamic NAT, you must enable the port block allocation parameter in the bound LSN pool. For Deterministic NAT, the port block allocation parameter is always enabled, and you cannot disable it.

In Dynamic NAT, the Citrix ADC allocates a random NAT port block, from the available NAT port pool of an NAT IP address, for each subscriber. For a subscriber, if all the ports are allocated from the subscriber’s allocated port block, the ADC allocates a new random port block for the subscriber.

The default port block size is 256 for Deterministic NAT, and 0 for Dynamic NAT. Default value: 0 Minimum value: 256 Maximum value: 65536

logging Log mapping entries and sessions created or deleted for this LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

The ADC uses its existing syslog and audit log framework to log LSN information. You must enable global level LSN logging by enabling the LSN parameter in the related NSLOG action and SYLOG action entities. When the Logging parameter is enabled, the Citrix ADC generates log messages related to LSN mappings and LSN sessions of this LSN group. The ADC then sends these log messages to servers associated with the NSLOG action and SYSLOG actions entities.

A log message for an LSN mapping entry consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN mapping entry is created or deleted
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID might be present, depending on the following conditions: ` Destination IP address and port are not logged for Endpoint-Independent mapping ` Only Destination IP address (and not port) is logged for Address-Dependent mapping ` Destination IP address and port are logged for Address-Port-Dependent mapping

Possible values: ENABLED, DISABLED Default value: DISABLED

sessionLogging Log sessions created or deleted for the LSN group. The Citrix ADC logs LSN sessions for this LSN group only when both logging and session logging parameters are enabled.

A log message for an LSN session consists of the following information:

  • NSIP address of the Citrix ADC
  • Time stamp
  • Entry type (MAPPING or SESSION)
  • Whether the LSN session is created or removed
  • Subscriber’s IP address, port, and traffic domain ID
  • NAT IP address and port
  • Protocol name
  • Destination IP address, port, and traffic domain ID

Possible values: ENABLED, DISABLED Default value: DISABLED

sessionSync In a high availability (HA) deployment, synchronize information of all LSN sessions related to this LSN group with the secondary node. After a failover, established TCP connections and UDP packet flows are kept active and resumed on the secondary node (new primary).

For this setting to work, you must enable the global session synchronization parameter.

Possible values: ENABLED, DISABLED Default value: ENABLED

snmptraplimit Maximum number of SNMP Trap messages that can be generated for the LSN group in one minute. Default value: 100 Minimum value: 0 Maximum value: 10000

ftp Enable Application Layer Gateway (ALG) for the FTP protocol. For some application-layer protocols, the IP addresses and protocol port numbers are usually communicated in the packet’s payload. When acting as an ALG, the Citrix ADC changes the packet’s payload to ensure that the protocol continues to work over LSN.

Note: The Citrix ADC also includes ALG for ICMP and TFTP protocols. ALG for the ICMP protocol is enabled by default, and there is no provision to disable it. ALG for the TFTP protocol is disabled by default. ALG is enabled automatically for an LSN group when you bind a UDP LSN application profile, with endpoint-independent-mapping, endpoint-independent filtering, and destination port as 69 (well-known port for TFTP), to the LSN group.

Possible values: ENABLED, DISABLED Default value: ENABLED

pptp Enable the PPTP Application Layer Gateway.

Possible values: ENABLED, DISABLED Default value: DISABLED

sipalg Enable the SIP ALG.

Possible values: ENABLED, DISABLED Default value: DISABLED

rtspalg Enable the RTSP ALG.

Possible values: ENABLED, DISABLED Default value: DISABLED

ip6profile Name of the LSN ip6 profile to associate with the specified LSN group. An ip6 profile can be associated with a group only during group creation.

By default, no LSN ip6 profile is associated with an LSN group during its creation. Only one ip6profile can be associated with a group.

ftpcm Enable the FTP connection mirroring for specified LSN group. Connection mirroring (CM or connection failover) refers to keeping active an established TCP or UDP connection when a failover occurs.

Possible values: ENABLED, DISABLED Default value: DISABLED

Example

add lsn group group1

rm lsn group

Remove LSN Group.

Synopsis

rm lsn group

Arguments

groupname Name for the LSN group. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the LSN group is created. The following requirement applies only to the Citrix ADC CLI: If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “lsn group1” or ‘lsn group1’).

Example

rm lsn group group1

lsn-group