- Citrix ADC Release Notes
-
Getting Started with Citrix ADC
- Where Does a Citrix ADC Appliance Fit in the Network?
- How a Citrix ADC Communicates with Clients and Servers
- Introduction to the Citrix ADC Product Line
- Install the hardware
- Access a Citrix ADC
- Configure the ADC for the first time
- Configure high availability
- Configuring a FIPS Appliance for the First Time
- Understanding Common Network Topologies
- System management settings
- Load balance traffic on a Citrix ADC appliance
- Accelerate load balanced traffic by using compression
- Secure load balanced traffic by using SSL
- Features at a Glance
- FAQ
-
Solutions for Telecom Service Providers
-
Large Scale NAT
- Points to Consider before Configuring LSN
- Configuration Steps for LSN
- Sample LSN Configurations
- Configuring Static LSN Maps
- Configuring Application Layer Gateways
- Logging and Monitoring LSN
- STUN Timeout
- TCP SYN Idle Timeout
- Overriding LSN configuration with Load Balancing Configuration
- Clearing LSN Sessions
- Load Balancing SYSLOG Servers
- Port Control Protocol
- LSN44 in a cluster setup
- Dual-Stack Lite
-
Large Scale NAT64
- Points to Consider for Configuring Large Scale NAT64
- Configuring DNS64
- Configuring Large Scaler NAT64
- Configuring Application Layer Gateways for Large Scale NAT64
- Configuring Static Large Scale NAT64 Maps
- Logging and Monitoring Large Scale NAT64
- Port Control Protocol for Large Scale NAT64
- LSN64 in a cluster setup
- Mapping Address and Port using Translation
- Telco subscriber management
- Load Balance Control-Plane Traffic that is based on Diameter, SIP, and SMPP Protocols
- Provide DNS Infrastructure/Traffic Services, such as, Load Balancing, Caching, and Logging for Telecom Service Providers
- Provide Subscriber Load Distribution Using GSLB Across Core-Networks of a Telecom Service Provider
- Bandwidth Utilization Using Cache Redirection Functionality
- Citrix ADC TCP Optimization
- Citrix ADC Video Optimization
- Citrix ADC URL Filtering
-
Large Scale NAT
- Citrix ADC Solutions
-
Deploy a Citrix ADC VPX instance
- Support matrix and usage guidelines
- Install a Citrix ADC VPX instance on XenServer
-
Install a Citrix ADC VPX instance on VMware ESX
- Configuring Citrix ADC Virtual Appliances to use VMXNET3 Network Interface
- Configuring Citrix ADC Virtual Appliances to use Single Root I/O Virtualization (SR-IOV) Network Interface
- Migrating the Citrix ADC VPX from E1000 to SR-IOV or VMXNET3 Network Interfaces
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Install a Citrix ADC VPX instance on Microsoft Hyper-V servers
-
Install a Citrix ADC VPX instance on Linux-KVM platform
- Prerequisites for Installing Citrix ADC VPX Virtual Appliances on Linux-KVM Platform
- Provisioning the Citrix ADC Virtual Appliance by using OpenStack
- Provisioning the Citrix ADC Virtual Appliance by using the Virtual Machine Manager
- Configuring Citrix ADC Virtual Appliances to Use SR-IOV Network Interface
- Configuring Citrix ADC Virtual Appliances to use PCI Passthrough Network Interface
- Provisioning the Citrix ADC Virtual Appliance by using the virsh Program
- Managing the Citrix ADC Guest VMs
- Provisioning the Citrix ADC Virtual Appliance with SR-IOV, on OpenStack
- Configuring a Citrix ADC VPX Instance on KVM to Use OVS DPDK-Based Host Interfaces
-
Deploy a Citrix ADC VPX instance on AWS
- Limitations and usage guidelines
- Prerequisites
- Deploy a Citrix ADC VPX standalone instance on AWS
- Scenario: standalone instance
- Download a Citrix ADC VPX license
- Load balancing servers in different availability zones
- Deploy a high availability pair on AWS
- High availability across AWS availability zones
- Add back-end AWS auto scaling service
- Configure a Citrix ADC VPX instance to use SR-IOV network interface
- Upgrade a Citrix ADC VPX instance on AWS
- Troubleshoot a VPX instance on AWS
-
Deploy a Citrix ADC VPX instance on Microsoft Azure
- Configure a Citrix ADC standalone instance
- Configure multiple IP addresses for a Citrix ADC VPX standalone instance
- Configure a high-availability setup with multiple IP addresses and NICs
- Configure a high-availability setup with multiple IP addresses and NICs by using PowerShell commands
- Configure a high-availability setup with a single IP address and a single NIC
- Add Azure autoscale settings
- Configure GSLB on Citrix ADC VPX instances
- Configure GSLB on an ctive-standby high availability setup
- Configure address pools (IIP) for a Citrix Gateway appliance
- Configure multiple IP addresses for a Citrix ADC VPX instance in standalone mode by using PowerShell commands
- Configure multiple Azure VIPs for a standalone or high availability Citrix ADC instance
- Additional PowerShell scripts for Azure deployment
- Azure terminology
- Deploy a Citrix ADC VPX instance on Google Cloud Platform
- Jumbo frames on Citrix ADC VPX instances
- Licensing
- Upgrade and downgrade a Citrix ADC appliance
-
Authentication, authorization, and auditing application traffic
- How Authentication, authorization, and auditing works
- Enabling AAA
- Setting up an authentication virtual server
- Creating an authentication profile
- Configuring users and groups
- Configuring authentication, authorization, and auditing policies
- Self-service password reset
- Authorizing user access to application resources
- Auditing authenticated sessions
- Session settings
- Traffic settings
- Authenticating with client certificates
- Configuring Authentication, authorization, and auditing with commonly used protocols
- Citrix ADC Kerberos single sign-on
- SAML authentication
- OAuth authentication
- Multi-Factor (nFactor) authentication
- Configuring the OpenID Connect Protocol
- Admin Partitioning
-
AppExpert
- Action Analytics
-
AppExpert Applications and Templates
- How AppExpert application works
- Get started with AppExpert
- Customize AppExpert Configuration
- Configure user authentication
- Monitor Citrix ADC statistics
- Delete an AppExpert application
- Configure application authentication, authorization, and auditing
- Set up a custom Citrix ADC application
- Creating and Managing Template Files
- Citrix Gateway Applications
- AppQoE
- Entity Templates
-
HTTP Callouts
- How an HTTP Callout Works
- Notes on the Format of HTTP Requests and Responses
- Configuring an HTTP Callout
- Verifying the Configuration
- Invoking an HTTP Callout
- Avoiding HTTP Callout Recursion
- Caching HTTP Callout Responses
- Use Case: Filtering Clients by Using an IP Blacklist
- Use Case: ESI Support for Fetching and Updating Content Dynamically
- Use Case: Access Control and Authentication
- Use Case: OWA-Based Spam Filtering
- Use Case: Dynamic Content Switching
- Pattern Sets and Data Sets
- Variables
-
Policies and Expressions
- Introduction to Policies and Expressions
- Configuring Advanced Policy Infrastructure
- Configuring Advanced Policy Expression: Getting Started
- Advanced Policy Expressions: Evaluating Text
- Advanced Policy Expressions: Working with Dates, Times, and Numbers
- Advanced Policy Expressions: Parsing HTTP, TCP, and UDP Data
- Advanced Policy Expressions: Parsing SSL Certificates
- Advanced Policy Expressions: IP and MAC Addresses, Throughput, VLAN IDs
- Advanced Policy Expressions: Stream Analytics Functions
- Advanced Policy Expressions: DataStream
- Typecasting Data
- Regular Expressions
- Configuring Classic Policies and Expressions
- Expressions Reference-Advanced Policy Expressions
- Expressions Reference-Classic Expressions
- Summary Examples of Default Syntax Expressions and Policies
- Tutorial Examples of Default Syntax Policies for Rewrite
- Tutorial Examples of Classic Policies
- Migration of Apache mod_rewrite Rules to the Default Syntax
-
Rate Limiting
- Configuring a Stream Selector
- Configuring a Traffic Rate Limit Identifier
- Configuring and Binding a Traffic Rate Policy
- Viewing the Traffic Rate
- Testing a Rate-Based Policy
- Examples of Rate-Based Policies
- Sample Use Cases for Rate-Based Policies
- Rate Limiting for Traffic Domains
- Configure rate limit at packet level
-
Responder
- Enabling the Responder Feature
- Configuring a Responder Action
- Configuring a Responder Policy
- Binding a Responder Policy
- Setting the Default Action for a Responder Policy
- Responder Action and Policy Examples
- Diameter Support for Responder
- RADIUS Support for Responder
- DNS Support for the Responder Feature
- How to Redirect HTTP Requests
- Troubleshooting
-
Rewrite
- How Rewrite Works
- Enabling the Rewrite Feature
- Configuring a Rewrite Action
- Configuring a Rewrite Policy
- Binding a Rewrite Policy
- Configuring Rewrite Policy Labels
- Configuring the Default Rewrite Action
- Bypassing the Safety Check
- Rewrite Action and Policy Examples
- URL Transformation
- RADIUS Support for the Rewrite Feature
- Diameter Support for Rewrite
- DNS Support for the Rewrite Feature
- String Maps
- URL Sets
- AppFlow
-
Application Firewall
- FAQs and Deployment Guide
- Introduction
- Configuring the Application Firewall
-
Signatures
- Manually Configuring the Signatures Feature
- Adding or Removing a Signatures Object
- Configuring or Modifying a Signatures Object
- Protecting JSON Applications using Signatures
- Updating a Signatures Object
- Exporting a Signatures Object to a File
- The Signatures Editor
- Signature Updates in High-Availability Deployment and Build Upgrades
- Overview of Security checks
- Top-Level Protections
- Data Leak Prevention Checks
- Advanced Form Protection Checks
- URL Protection Checks
- XML Protection Checks
- Managing Content Types
- Profiles
- Policy Labels
- Policies
- Imports
- Global Configuration
- Statistics and Reports
- Application Firewall Logs
- Appendices
- Debugging and Troubleshooting
- Signatures Alert Articles
- Cache Redirection
-
Clustering
- Citrix ADC configuration support in a cluster
- Prerequisites for cluster nodes
- Cluster overview
- Setting up a Citrix ADC cluster
- Distributing traffic across cluster nodes
-
Managing the Citrix ADC cluster
- Configuring linksets
- Nodegroups for spotted and partially-striped configurations
- Configuring redundancy for nodegroups
- Disabling steering on the cluster backplane
- Synchronizing cluster configurations
- Synchronizing time across cluster nodes
- Synchronizing cluster files
- Viewing the statistics of a cluster
- Discovering Citrix ADC appliances
- Disabling a cluster node
- Removing a cluster node
- Removing a node from a cluster deployed using cluster link aggregation
- Detecting jumbo probe on a cluster
- Route monitoring for dynamic routes in cluster
- Monitoring cluster setup using SNMP MIB with SNMP link
- Monitoring command propagation failures in a cluster deployment
- Graceful shutdown of nodes
- Graceful shutdown of services
- IPv6 ready logo support for clusters
- Managing cluster heartbeat messages
- Configuring owner node response status
- Monitor Static Route (MSR) support for inactive nodes in a spotted cluster configuration
- VRRP interface binding in a single node active cluster
-
Cluster setup and usage scenarios
- Creating a two-node cluster
- Migrating an HA setup to a cluster setup
- Transitioning between a L2 and L3 cluster
- Setting up GSLB in a cluster
- Using cache redirection in a cluster
- Using L2 mode in a cluster setup
- Using cluster LA channel with linksets
- Backplane on LA channel
- Common interfaces for client and server and dedicated interfaces for backplane
- Common switch for client, server, and backplane
- Common switch for client and server and dedicated switch for backplane
- Different switch for every node
- Sample cluster configurations
- Using VRRP in a cluster setup
- Backup and restore of cluster setup
- Upgrading or downgrading the Citrix ADC cluster
- Operations supported on individual cluster nodes
- Support for heterogeneous cluster
- FAQs
- Troubleshooting the Citrix ADC cluster
- Content Switching
-
DataStream
- Configuring Database Users
- Configuring a Database Profile
- Configuring Load Balancing for DataStream
- Configuring Content Switching for DataStream
- Configuring Monitors for DataStream
- Use Case 1: Configuring DataStream for a Master/Slave Database Architecture
- Use Case 2: Configuring the Token Method of Load Balancing for DataStream
- Use Case 3: Logging MSSQL Transactions in Transparent Mode
- Use Case 4: Database Specific Load Balancing
- DataStream Reference
-
Domain Name System
-
Configure DNS resource records
- Create SRV records for a service
- Create AAAA Records for a domain name
- Create address records for a domain name
- Create MX records for a mail exchange server
- Create NS records for an authoritative server
- Create CNAME records for a subdomain
- Create NAPTR records for telecommunications domain
- Create PTR records for IPv4 and IPv6 addresses
- Create SOA records for authoritative information
- Create TXT records for holding descriptive text
- View DNS statistics
- Configure a DNS zone
- Configure the Citrix ADC as an ADNS server
- Configure the Citrix ADC as a DNS proxy server
- Configure the Citrix ADC as an end resolver
- Configure the Citrix ADC as a forwarder
- Configure Citrix ADC as a non-validating security aware stub-resolver
- Jumbo frames support for DNS to handle responses of large sizes
- Configure DNS logging
- Configure DNS suffixes
- DNS ANY query
- Configure negative caching of DNS records
- Caching of EDNS0 client subnet data when the Citrix ADC appliance is in proxy mode
- Domain name system security extensions
- Support wildcard DNS domains
- Mitigate DNS DDoS attacks
-
Configure DNS resource records
- Firewall Load Balancing
-
Global Server Load Balancing
- GSLB deployment types
- GSLB configuration entities
- GSLB methods
- Configure static proximity
- Configure site-to-site communication
- Configure metrics exchange protocol
- Configure GSLB by using a wizard
- Configure GSLB entities individually
- Synchronize the configuration in a GSLB setup
- GSLB dashboard
- Monitor GSLB services
- Use case: Deployment of domain name based autoscale service group
- Use case: Deployment of IP address based autoscale service group
-
How-to articles
- Customize your GSLB configuration
- Configure persistent connections
- Manage client connections
- Configure GSLB for proximity
- Protect the GSLB setup against failure
- Configure GSLB for disaster recovery
- Override static proximity behavior by configuring preferred locations
- Configure GSLB service selection using content switching
- Configure GSLB for DNS queries with NAPTR records
- Use the EDNS0 client subnet option for GSLB
- Example of a complete parent-child configuration using the metrics exchange protocol
- Link Load Balancing
-
Load Balancing
- How load balancing works
- Set up basic load balancing
- Load balance virtual server and service states
- Support for load balancing profile
- Load balancing algorithms
-
Persistence and persistent connections
- About Persistence
- Source IP address persistence
- HTTP cookie persistence
- SSL session ID persistence
- Diameter AVP number persistence
- Custom server ID persistence
- IP address persistence
- SIP Call ID persistence
- RTSP session ID persistence
- Configure URL passive persistence
- Configure persistence based on user-defined rules
- Configure persistence types that do not require a rule
- Configure backup persistence
- Configure persistence groups
- Share persistent sessions between virtual servers
- Configure RADIUS load balancing with persistence
- View persistence sessions
- Clear persistence sessions
- Override persistence settings for overloaded services
- Troubleshooting
- Customize a load balancing configuration
- Configure diameter load balancing
- Configure FIX load balancing
- Protect a load balancing configuration against failure
- Manage a load balancing setup
-
Manage client traffic
- Configure sessionless load balancing virtual servers
- Redirect HTTP requests to a cache
- Direct requests according to priority
- Direct requests to a custom web page
- Enable cleanup of virtual server connections
- Rewrite ports and protocols for HTTP redirection
- Insert IP address and port of a virtual server in the request header
- Use a specified source IP for backend communication
- Set a time-out value for idle client connections
- Manage RTSP connections
- Manage client traffic on the basis of traffic rate
- Identify a connection with layer 2 parameters
- Configure the prefer direct route option
- Use a source port from a specified port range for backend communication
- Configure source IP persistency for backend communication
- Use IPv6 link local addresses on server side of a load balancing setup
-
Advanced load balancing settings
- Gradually stepping up the load on a new service with virtual server–level slow start
- The no-monitor option for services
- Protect applications on protected servers against traffic surges
- Enable cleanup of virtual server and service connections
- Graceful shutdown of services
- Enable or disable persistence session on TROFS services
- Direct requests to a custom web page
- Enable access to services when down
- Enable TCP buffering of responses
- Enable compression
- Maintain client connection for multiple client requests
- Insert the IP address of the client in the request header
- Retrieve location details from user IP address using geolocation database
- Use source IP address of the client when connecting to the server
- Use client source IP address for backend communication in a v4-v6 load balancing configuration
- Configure the source port for server-side connections
- Set a limit on the number of client connections
- Set a limit on number of requests per connection to the server
- Set a threshold value for the monitors bound to a service
- Set a timeout value for idle client connections
- Set a timeout value for idle server connections
- Set a limit on the bandwidth usage by clients
- Redirect client requests to a cache
- Retain the VLAN identifier for VLAN transparency
- Configure automatic state transition based on percentage health of bound services
-
Built-in monitors
- TCP-based application monitoring
- SSL service monitoring
- FTP service monitoring
- Secure monitoring of servers by using SFTP
- Set SSL parameters on a secure monitor
- SIP service monitoring
- RADIUS service monitoring
- Monitor accounting information delivery from a RADIUS server
- DNS and DNS-TCP service monitoring
- LDAP service monitoring
- MySQL service monitoring
- SNMP service monitoring
- NNTP service monitoring
- POP3 service monitoring
- SMTP service monitoring
- RTSP service monitoring
- XML broker service monitoring
- ARP request monitoring
- XenDesktop Delivery Controller service monitoring
- Web interface service monitoring
- Citrix StoreFront stores monitoring
- Custom monitors
- Configure monitors in a load balancing setup
- Manage a large scale deployment
- Configure load balancing for commonly used protocols
- Use case 1: SMPP load balancing
- Use case 2: Configure rule based persistence based on a name-value pair in a TCP byte stream
- Use case 3: Configure load balancing in direct server return mode
- Use case 4: Configure LINUX servers in DSR mode
- Use case 5: Configure DSR mode when using TOS
- Use case 6: Configure load balancing in DSR mode for IPv6 networks by using the TOS field
- Use case 7: Configure load balancing in DSR mode by using IP Over IP
- Use case 8: Configure load balancing in one-arm mode
- Use case 9: Configure load balancing in the inline mode
- Use case 10: Load balancing of intrusion detection system servers
- Use case 11: Isolating network traffic using listen policies
- Use case 12: Configure XenDesktop for load balancing
- Use case 13: Configure XenApp for load balancing
- Use case 14: ShareFile wizard for load balancing Citrix ShareFile
- Troubleshooting
- Load balancing FAQs
-
Networking
- IP Addressing
-
Interfaces
- Configuring MAC-Based Forwarding
- Configuring Network Interfaces
- Configuring Forwarding Session Rules
- Understanding VLANs
- Configuring a VLAN
- Configuring NSVLAN
- Configuring Allowed VLAN List
- Configuring Bridge Groups
- Configuring VMACs
- Configuring Link Aggregation
- Redundant Interface Set
- Binding an SNIP address to an Interface
- Monitoring the Bridge Table and Changing the Aging time
- Citrix ADC Appliances in Active-Active Mode Using VRRP
- Using the Network Visualizer
- Configuring Link Layer Discovery Protocol
- Jumbo Frames
- Citrix ADC Support for Microsoft Direct Access Deployment
- Access Control Lists
- IP Routing
- Internet Protocol version 6 (IPv6)
- Traffic Domains
- VXLAN
- Priority Load Balancing
-
Citrix ADC Extensions
- Citrix ADC extensions - language overview
- Citrix ADC extensions - library reference
- Citrix ADC extensions API reference
-
Protocol extensions
- Protocol extensions - architecture
- Protocol extensions - traffic pipeline for user defined TCP client and server behaviors
- Protocol extensions - use cases
- Tutorial – Add MQTT protocol to the Citrix ADC appliance by using protocol extensions
- Tutorial - Load balancing syslog messages by using protocol extensions
- Protocol extensions command reference
- Troubleshoot protocol extensions
- Policy extensions
-
Optimization
- Client Keep-Alive
- HTTP Compression
-
Integrated Caching
- Configure selectors and basic content groups
- Configure policies for caching and invalidation
- Cache support for database protocols
- Configure expressions for caching policies and selectors
- Display cached objects and cache statistics
- Improve cache performance
- Configure cookies, headers, and polling
- Configure integrated cache as a forward proxy
- Default Settings for the Integrated Cache
- Troubleshooting
- Front End Optimization
- Content Accelerator
- Media Classification
- Reputation
-
SSL offload and acceleration
- SSL offloading configuration
- TLSv1.3 protocol support as defined in RFC 8446
- How-to articles
- SSL certificates
- SSL profiles
- Certificate revocation lists
- Monitor certificate status with OCSP
- OCSP stapling
- Ciphers available on the Citrix ADC appliances
- Server certificate support matrix on the ADC appliance
- Client authentication
- Server authentication
- SSL actions and policies
- Selective SSL logging
- Support for DTLS protocol
- Support for Intel Coleto SSL chip based platforms
- MPX 9700/10500/12500/15500 FIPS appliances
- MPX 14000 FIPS appliances
-
SDX 14000 FIPS appliances
- Limitations
- Terminology
- Initialize the HSM
- Create partitions
- Provision a new instance or modify an existing instance and assign a partition
- Configure the HSM for an instance on an SDX 14030/14060/14080 FIPS appliance
- Create a FIPS key for an instance on an SDX 14030/14060/14080 FIPS appliance
- Upgrade the FIPS firmware on a VPX instance
- Support for Thales nShield® HSM
- Support for Gemalto SafeNet Network hardware security module
- Troubleshooting
- SSL FAQs
- Global site certificates
- Security
-
System
- Basic operations
- Authentication and authorization
- TCP Configurations
- HTTP Configurations
- SNMP
- Audit Logging
- Web Server Logging
- Call Home
- Reporting Tool
-
CloudBridge Connector
- Monitoring CloudBridge Connector Tunnels
- Configuring a CloudBridge Connector Tunnel between two Datacenters
- Configuring CloudBridge Connector between Datacenter and AWS Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Virtual Private Gateway on AWS
- Configuring a CloudBridge Connector Tunnel Between a Datacenter and Azure Cloud
- Configuring CloudBridge Connector Tunnel between Datacenter and SoftLayer Enterprise Cloud
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Cisco IOS Device
- Configuring a CloudBridge Connector Tunnel Between a Citrix ADC Appliance and Fortinet FortiGate Appliance
- CloudBridge Connector Tunnel Diagnostics and Troubleshooting
- CloudBridge Connector Interoperability – StrongSwan
- CloudBridge Connector Interoperability – F5 BIG-IP
- CloudBridge Connector Interoperability – Cisco ASA
-
High Availability
- Points to Consider for a High Availability Setup
- Configuring High Availability
- Configuring the Communication Intervals
- Configuring Synchronization
- Synchronizing Configuration Files in a High Availability Setup
- Configuring Command Propagation
- Restricting High-Availability Synchronization Traffic to a VLAN
- Configuring Fail-Safe Mode
- Configuring Virtual MAC Addresses
- Configuring High Availability Nodes in Different Subnets
- Configuring Route Monitors
- Limiting Failovers Caused by Route Monitors in non-INC mode
- Configuring Failover Interface Set
- Understanding the Causes of Failover
- Forcing a Node to Fail Over
- Forcing the Secondary Node to Stay Secondary
- Forcing the Primary Node to Stay Primary
- Understanding the High Availability Health Check Computation
- High Availability FAQs
- Troubleshooting High Availability Issues
- Managing High Availability Heartbeat Messages on a Citrix ADC Appliance
- Remove and Replace a Citrix ADC in a High Availability Setup
- TCP Optimization
- Troubleshooting Citrix ADC
- Reference Material
This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
This content has been machine translated dynamically.
This content has been machine translated dynamically.
This content has been machine translated dynamically.
Translation failed!
TCP Configurations
TCP configurations for a Citrix ADC appliance can be specified in an entity called a TCP profile, which is a collection of TCP settings. The TCP profile can then be associated with services or virtual servers that want to use these TCP configurations.
A default TCP profile can be configured to set the TCP configurations that will be applied by default, globally to all services and virtual servers.
Note
When a TCP parameter has different values for service, virtual server, and globally, the value of the most-specific entity (the service) is given the highest precedence. The Citrix ADC appliance also provides other approaches for configuring TCP. Read on for more information.
Supported TCP configuration
The Citrix ADC appliance supports the following TCP capabilities:
Defending TCP against spoofing attacks
The Citrix ADC implementation of window attenuation is RFC 4953 compliant.
Explicit Congestion Notification (ECN)
The appliance sends notification of the network congestion status to the sender of the data and takes corrective measures for data congestion or data corruption. The Citrix ADC implementation of ECN is RFC 3168 compliant.
Round trip time measurement (RTTM) using the timestamp option
For the TimeStamp option to work, at least one side of the connection (client or server) must support it. The Citrix ADC implementation of TimeStamp option is RFC 1323 compliant.
Detection of spurious retransmissions
This can be done using TCP duplicate selective acknowledgement (D-SACK) and forward RTO-Recovery (F-RTO). In case of spurious retransmissions, the congestion control configurations are reverted to their original state. The Citrix ADC implementation of D-SACK is RFC 2883 compliant, and F-RTO is RFC 5682 compliant.
Congestion control
This functionality use New-Reno, BIC, CUBIC, Nile and TCP Westwood algorithms.
Window scaling
This increases the TCP receive window size beyond its maximum value of 65,535 bytes.
Points to consider before you configure window scaling
- You do not set a high value for the scale factor, because this could have adverse effects on the appliance and the network.
- You do not configure window scaling unless you clearly know why you want to change the window size.
- Both hosts in the TCP connection send a window scale option during connection establishment. If only one side of a connection sets this option, window scaling is not used for the connection.
- Each connection for same session is an independent window scaling session. For example, when a client’s request and the server’s response flow through the appliance, it is possible to have window scaling between the client and the appliance without window scaling between the appliance and the server.
TCP maximum congestion window
The window size is a user configurable one. The default value is 8190 bytes.
Selective acknowledgment (SACK)
This uses the data receiver (either a Citrix ADC appliance or a client) notifies the sender about all the segments that have been received successfully.
Forward acknowledgment (FACK)
This functionality avoids TCP congestion by explicitly measuring the total number of data bytes outstanding in the network, and helping the sender (either a Citrix ADC or a client) control the amount of data injected into the network during retransmission timeouts.
TCP connection multiplexing
This functionality enables reuse of existing TCP connections. The Citrix ADC appliance stores established TCP connections to the reuse pool. Whenever a client request is received, appliance checks for an available connection in the reuse pool and serves the new client if the connection is available. If it is unavailable, the appliance creates a new connection for the client request and stores the connection to the reuse pool. Citrix ADC supports connection multiplexing for HTTP, SSL, and DataStream connection types.
Dynamic receive buffering
This allows the receive buffer to be adjusted dynamically based on memory and network conditions.
MPTCP Connection
MPTCP connections between client and Citrix ADC. MPTCP connections are not supported between Citrix ADC and the backend server. The Citrix ADC implementation of MPTCP is RFC 6824 compliant.
You can view MPTCP statistics such as active MPTCP connections and active subflow connections by using the command line interface.
At the command prompt, type one of the following commands to display a summary or detailed summary of MPTCP statistics, or to clear the statistics display:
-
Stat MPTCP
-
Stat mptcp –detail
-
Clearstats basic
Note
To establish an MPTCP connection, both the client and the Citrix ADC appliance must support the same MPTCP version. If you use the Citrix ADC appliance as an MPTCP gateway for your servers, the servers do not have to support MPTCP. When the client starts a new MPTCP connection, the appliance identifies the client’s MPTPC version from the MP_CAPABALE option in the SYN packet. If the client’s version is higher than the one supported on the appliance, the appliance indicates its highest version in the MP_CAPABALE option of the SYN-ACK packet. The client then falls back to a lower version and sends the version number in the MP_CAPABALE option of the ACK packet. If that version is supportable, the appliance continues the MPTCP connection. Otherwise, the appliance falls back to a regular TCP. The Citrix ADC appliance does not initiate subflows (MP_JOIN’s). The appliance expects the client to initiate subflows.
Extracting the TCP/IP path overlay option and inserting client-IP HTTP header
Extracting TCP/IP path overlay and inserting client-IP HTTP header. Data transport through overlay networks often uses connection termination or Network Address Translation (NAT), in which the IP address of the source client is lost. To avoid this, the Citrix ADC appliance extracts the TCP/IP path overlay option and inserts the source client’s IP address into the HTTP header. With the IP address in the header, the web server can identify the source client that made the connection. The extracted data is valid for lifetime of the TCP connection and therefore, this prevents the next hop host from having to interpret the option again. This option is applicable only for web services that have the client-IP insertion option enabled. For more information, see Client Insertion on backend topic.
TCP segmentation offload
Synchronizing cookie for TCP handshake with clients
Learning MSS to enable MSS learning for all the virtual servers configured on the appliance
Supportable TCP Parameters
The following table provides a list of TCP parameters and its default value configured on a Citrix ADC appliance.
Parameter | Default Value | Description |
---|---|---|
Window Management | ||
TCP Delayed-ACK Timer | 100 millisec | Timeout for TCP delayed ACK, in milliseconds. |
TCP minimum Restransmission Timeout(RTO) in millisec | 1000 millisec | Minimum retransmission timeout, in milliseconds, specified in 10-millisecond increments (value must yield a whole number if divided by 10) |
Connection idle time before starting keep-alive probes | 900 seconds | Silently drop tcp established connections on idle timeoutcp established connections on idle timeout |
TCP Timestamp Option | ENABLED | The timestamp option allows for accurate RTT measurement. Enable or Disable TCP Timestamp option. |
Multipath TCP session timeout | 0 seconds | MPTCP session timeout in seconds. If this value is not set, idle. MPTCP sessions are flushed after vserver’s client idle timeout. |
Silently Drop HalfClosed connections on idle timeout | 0 seconds | Silently drop TCP half closed connections on idle timeout. |
Silently Drop Established connections on idle timeout | DISABLED | Silently drop tcp established connections on idle timeout |
Memory Management | ||
TCP Buffer Size | 131072 bytes | TCP buffer size is the receive buffer size on Citrix ADC. This buffer size is advertised to clients and servers from Citrix ADC and it controls their ability to send data to Citrix ADC. The default buffer size is 8K and in most cases it will be safe to increment this when talking to internal server farms. The buffer size is also impact by the actual application layer in Citrix ADC like for SSL endpoint cases it is set to 40K and for Compression it is set to 96K. |
Note: The buffer size argument must be set for dynamic adjustments to take place. | ||
TCP Send Buffer Size | 8190 bytes | TCP Send Buffer Size |
TCP Dynamic Receive Buffering | DISABLED | Enable or disable dynamic receive buffering. When enabled, it allows the receive buffer to be adjusted dynamically based on memory and network conditions. Note: The buffer size argument must be set for dynamic adjustments to take place |
TCP Max congestion window(CWND) | 524288 bytes | TCP Maximum Congestion Window |
Window Scaling status | ENALBED | Enable or disable window scaling. |
Window Scaling factor | 8 | Factor used to calculate the new window size.This argument is needed only when window scaling is enabled. |
Connection Setup | ||
Keep-alive probes | DISABLED | Send periodic TCP keep-alive (KA) probes to check if peer is still up. |
Connection idle time before starting keep-alive probes | 900 seconds | Duration, in seconds, for the connection to be idle, before sending a keep-alive (KA) probe. |
Keep-alive probe interval | 75 seconds | Time interval, in seconds, before the next keep-alive (KA) probe, if the peer does not respond. |
Maximum keep-alive probes to be missed before dropping connection. | 3 | Number of keep-alive (KA) probes to be sent when not acknowledged, before assuming the peer to be down. |
RST window attenuation (spoof protection). | DISABLED | Enable or disable RST window attenuation to protect against spoofing. When enabled, will reply with corrective ACK when a sequence number is invalid. |
Accept RST with last acknowledged sequence number. | ENABLED | |
Data transfer | ||
Immediate ACK on PUSH packet | ENABLED | Send immediate positive acknowledgement (ACK) on receipt of TCP packets with PUSH flag. |
Maximum packets per MSS | 0 | Maximum number of octets to allow in a TCP data segment |
Nagle’s Algorithm | DISABLED | Nagle’s Algorithm fights with the problem of small packets in TCP transmission. Applications like Telnet and other real time engines which require every key stroke to be passed to the other side often create very small packets. With Nagle’s algorithm Citrix ADC can buffer such small packets and sends them together to increase on the connection efficiency. This algorithm needs to work along with other TCP optimization techniques in Citrix ADC. |
Maximum TCP segments allowed in a burst | 10 MSS | Maximum number of TCP segments allowed in a burst |
Maximum out-of-order packets to queue | 300 | Maximum size of out-of-order packets queue. A value of 0 means no limit |
Congestion Control | ||
TCP Flavor | CUBIC | |
Initial congestion window(cwnd) setting | 4 MSS | Initial maximum upper limit on the number of TCP packets that can be outstanding on the TCP link to the server |
TCP Explicit Congestion Notification(ECN) | DISABLED | Explicit Congestion Notification (ECN) provides end to end notification of network congestion without dropping packets. |
TCP Max congestion window(CWND) | 524288 bytes | TCP maintains a congestion window (CWND), limiting the total number of unacknowledged packets that may be in transit end-to-end. In TCP, the congestion window is one of the factors that determines the number of bytes that can be outstanding at any time.The congestion window is a means of stopping a link between the sender and the receiver from becoming overloaded with too much traffic. It is calculated by estimating how much congestion there is on the link. |
TCP Hybrid Start (HYSTART) | 8 bytes | |
TCP minimum Restransmission Timeout(RTO) in millisec | 1000 | Minimum retransmission timeout, in milliseconds, specified in 10-millisecond increments (value must yield a whole number if divided by 10). |
TCP dupack threshold | DISABLED | |
Burst Rate Control | 3 | TCP Burst Rate Control DISABLED/FIXED/DYNAMIC. FIXED requires a TCP rate to be set |
TCP Rate | DISABLED | TCP connection payload send rate in Kb/s |
TCP Rate Maximum Queue | 0 | Maximum connection queue size in bytes, when BurstRateControl is used. |
MPTCP | ||
Multipath TCP | DISABLED | Multipath TCP (MPTCP) is a set of extensions to regular TCP to provide a Multipath TCP service, which enables a transport connection to operate across multiple paths simultaneously. |
Multipath TCP drop data on pre-established subflow | DISABLED | Enable or disable silently dropping the data on Pre-Established subflow. When enabled, DSS data packets are dropped silently instead of dropping the connection when data is received on pre established subflow. |
Multipath TCP fastopen | DISABLED | Enable or disable Multipath TCP fastopen. When enabled, DSS data packets are accepted before receiving the third ack of SYN handshake. |
Multipath TCP session timeout | 0 seconds | MPTCP session timeout in seconds. If this value is not set, idle MPTCP sessions are flushed after vserver’s client idle timeout. |
Security | ||
SYN spoof protection | DISABLED | Enable or disable drop of invalid SYN packets to protect against spoofing. When disabled, established connections will be reset when a SYN packet is received. |
TCP Syncookie | DISABLED | This is used for resisting SYN flood attacks. Enable or disable the SYNCOOKIE mechanism for TCP handshake with clients. Disabling SYNCOOKIE prevents SYN attack protection on the Citrix ADC appliance. |
Loss Detection and Recovery | ||
Duplicate Selective Acknowledgement (DSACK) | ENABLED | A Citrix ADC appliance uses Duplicate Selective Acknowledgement (DSACK) to determine if a retransmission was sent in error. |
Forward RTO recovery (FRTO) | ENABLED | Detects spurious TCP retransmission timeouts. After retransmitting the first unacknowledged segment triggered by a timeout, the algorithm of the TCP sender monitors the incoming acknowledgments to determine whether the timeout was spurious. It then decides whether to send new segments or retransmit unacknowledged segments. The algorithm effectively helps to avoid additional unnecessary retransmissions and thereby improves TCP performance in the case of a spurious timeout. |
TCP Forward Acknowledgment (FACK) | ENABLED | Enable or disable FACK (Forward ACK). |
Selective Acknowledgement(SACK) status | ENABLED | TCP SACK addresses the problem of multiple packet loss which reduces the overall throughput capacity. With selective acknowledgement the receiver can inform the sender about all the segments which are received successfully, enabling sender to only retransmit the segments which were lost. This technique helps Citrix ADC improve overall throughput and reduce the connection latency. |
Maximum packets per retransmission | 1 | Allows Citrix ADC to control how many packets to be retransmitted in one attempt. When Citrix ADC receives a partial ACK and it has to do retransmission then this setting is considered. This does not impact the RTO based retransmissions. |
TCP Delayed-ACK Timer | 100 millisec | Timeout for TCP delayed ACK, in milliseconds |
TCO Optimization | ||
TCP Optimization mode | TRANSPARENT | TCP Optimization modes TRANSPARENT/ENDPOINT |
Apply adaptive TCP optimizations | DISABLED | Apply Adaptive TCP optimizations |
TCP Segmentation Offload | AUTOMATIC | Offload TCP segmentation to the NIC. If set to AUTOMATIC, TCP segmentation will be offloaded to the NIC, if the NIC supports it. |
ACK Aggregation | DISABLED | Enable or disable ACK Aggregation |
Setting Global TCP Parameters
The Citrix ADC appliance allows you to specify values for TCP parameters that are applicable to all Citrix ADC services and virtual servers. This can be done using:
- Default TCP profile
- Global TCP command
- TCP buffering feature
Note:
The recvBuffSize parameter of the set ns tcpParam command is deprecated from release 9.2 onwards. In later releases, set the buffer size by using the bufferSize parameter of the set ns tcpProfile command. If you upgrade to a release where the recvBuffSize parameter is deprecated, the bufferSize parameter is set to its default value.
Default TCP profile
A TCP profile, named as nstcp_default_profile, is used to specify TCP configurations that will used if no TCP configurations are provided at the service or virtual server level.
Note:
Not all TCP parameters can be configured through the default TCP profile. Some settings have to be performed by using the global TCP command (see section below).
- The default profile does not have to be explicitly bound to a service or virtual server.
To configure the default TCP profile
-
Using the command line interface, at the command prompt enter:
set ns tcpProfile nstcp_default_profile …
-
On the GUI, navigate to System > Profiles, click TCP Profiles and update nstcp_default_profile.
Global TCP command
Another approach you can use to configure global TCP parameters is the global TCP command. In addition to some unique parameters, this command duplicates some parameters that can be set by using a TCP profile. Any update made to these duplicate parameters is reflected in the corresponding parameter in the default TCP profile.
For example, if the SACK parameter is updated using this approach, the value is reflected in the SACK parameter of the default TCP profile (nstcp_default_profile).
Note:
Citrix recommends that you use this approach only for TCP parameters that are not available in the default TCP profile.
To configure the global TCP command
-
Using the command line interface, at the command prompt enter:
set ns tcpParam …
-
On the GUI, navigate to System > Settings, click Change TCP parameters and update the required TCP parameters.
TCP buffering feature
Citrix ADC provides a feature called TCP buffering that you can use to specify the TCP buffer size. The feature can be enabled globally or at service level.
Note The buffer size can also be configured in the default TCP profile. If the buffer size has different values in the TCP buffering feature and the default TCP profile, the greater value is applied.
To configure the TCP buffering feature globally
-
At the command prompt enter:
enable ns mode TCPB
set ns tcpbufParam -size <positiveInteger> -memLimit <positiveInteger>
-
On the GUI, navigate to System > Settings, click Configure Modes and select TCP Buffering.
And, navigate to System > Settings, click Change TCP parameters and specify the values for Buffer size and Memory usage limit.
Setting Service or Virtual Server Specific TCP Parameters
Using TCP profiles, you can specify TCP parameters for services and virtual servers. You must define a TCP profile (or use a built-in TCP profile) and associate the profile with the appropriate service and virtual server.
Note:
You can also modify the TCP parameters of default profiles as per your requirements.
- You can specify the TCP buffer size at service level using the parameters specified by the TCP buffering feature.
To specify service or virtual server level TCP configurations by using the command line interface
At the command prompt, perform the following:
-
Configure the TCP profile.
set ns tcpProfile <profile-name>...
-
Bind the TCP profile to the service or virtual server.
set service <name> ....
**Example**:
`> set service service1 -tcpProfileName profile1`
To bind the TCP profile to the virtual server:
`set lb vserver <name> ....`
**Example**:
`> set lb vserver lbvserver1 -tcpProfileName profile1`
To specify service or virtual server level TCP configurations by using the GUI
At the GUI, perform the following:
-
Configure the TCP profile.
Navigate to System > Profiles > TCP Profiles, and create the TCP profile.
-
Bind the TCP profile to the service or virtual server.
Navigate to Traffic Management > Load Balancing > Services/Virtual Servers, and create the TCP profile, which should be bound to the service or virtual server.
Built-in TCP Profiles
For convenience of configuration, the Citrix ADC provides some built-in TCP profiles. Review the built-in profiles listed below and select a profile and use it as it is or modify it to meet your requirements. You can bind these profiles to your required services or virtual servers.
Built-in profile | Description |
---|---|
nstcp_default_profile | Represents the default global TCP settings on the appliance. |
nstcp_default_tcp_lan | Useful for back-end server connections, where these servers reside on the same LAN as the appliance. |
nstcp_default_tcp_lan_thin_stream | Similar to the nstcp_default_tcp_lan profile; however, the settings are tuned to small size packet flows. |
nstcp_default_tcp_interactive_stream | Similar to the nstcp_default_tcp_lan profile; however, it has a reduced delayed ACK timer and ACK on PUSH packet settings. |
nstcp_default_tcp_lfp | Useful for long fat pipe networks (WAN) on the client side. Long fat pipe networks have long delay, high bandwidth lines with minimal packet drops. |
nstcp_default_tcp_lfp_thin_stream | Similar to the nstcp_default_tcp_lfp profile; however, the settings are tuned for small size packet flows. |
nstcp_default_tcp_lnp | Useful for long narrow pipe networks (WAN) on the client side. Long narrow pipe networks have considerable packet loss once in a while. |
nstcp_default_tcp_lnp_thin_stream | Similar to the nstcp_default_tcp_lnp profile; however, the settings are tuned for small size packet flows. |
nstcp_internal_apps | Useful for internal applications on the appliance (for example, GSLB sitesyncing). This contains tuned window scaling and SACK options for the desired applications. This profile should not be bound to applications other than internal applications. |
nstcp_default_Mobile_profile | Useful for mobile devices. |
nstcp_default_XA_XD_profile | Useful for a XenApp or XenDesktop deployment. |
Sample TCP Configurations
Sample command line interface examples for configuring the following:
Defending TCP against spoofing attacks
Enable the Citrix ADC to defend TCP against spoof attacks. By default the “rstWindowAttenuation” parameter is disabled. This parameter is enabled to protect the appliance against spoofing. If you enable, it will reply with corrective acknowledgement (ACK) for an invalid sequence number. Possible values are Enabled, Disabled.
Where RST window attenuate parameter protects the appliance against spoofing. When enabled, will reply with corrective ACK when a sequence number is invalid.
> set ns tcpProfile profile1 -rstWindowAttenuate ENABLED -spoofSynDrop ENABLED
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Explicit Congestion Notification (ECN)
Enable ECN on the required TCP profile
> set ns tcpProfile profile1 -ECN ENABLED
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Selective ACKnowledgment (SACK)
Enable SACK on the required TCP profile.
> set ns tcpProfile profile1 -SACK ENABLED
Done
`> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Forward ACKnowledgment (FACK)
Enable FACK on the required TCP profile.
> set ns tcpProfile profile1 -FACK ENABLED
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Window Scaling (WS)
Enable window scaling and set the window scaling factor on the required TCP profile.
> set ns tcpProfile profile1 –WS ENABLED –WSVal 9
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Maximum Segment Size (MSS)
Update the MSS related configurations.
> set ns tcpProfile profile1 –mss 1460 - maxPktPerMss 512
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Citrix ADC to learn the MSS of a virtual server
Enable the Citrix ADC to learn the VSS and update other related configurations.
> set ns tcpParam -learnVsvrMSS ENABLED –mssLearnInterval 180 -mssLearnDelay 3600
Done
TCP keep-alive
Enable TCP keep-alive and update other related configurations.
> set ns tcpProfile profile1 –KA ENABLED –KaprobeUpdateLastactivity ENABLED -KAconnIdleTime 900 -KAmaxProbes 3 -KaprobeInterval 75
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Buffer size - using TCP profile
Specify the buffer size.
> set ns tcpProfile profile1 –bufferSize 8190
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Buffer size - using TCP buffering feature
Enable the TCP buffering feature (globally or for a service) and then specify the buffer size and the memory limit.
> enable ns feature TCPB
Done
> set ns tcpbufParam -size 64 -memLimit 64
Done
MPTCP
Enable MPTCP and then set the optional MPTCP configurations.
> set ns tcpProfile profile1 -mptcp ENABLED
Done
> set ns tcpProfile profile1 -mptcpDropDataOnPreEstSF ENABLED -mptcpFastOpen ENABLED -mptcpSessionTimeout 7200
Done
> set ns tcpparam -mptcpConCloseOnPassiveSF ENABLED -mptcpChecksum ENABLED -mptcpSFtimeout 0 -mptcpSFReplaceTimeout 10
-mptcpMaxSF 4 -mptcpMaxPendingSF 4 -mptcpPendingJoinThreshold 0 -mptcpRTOsToSwitchSF 2 -mptcpUseBackupOnDSS ENABLED
Done
Congestion control
Set the required TCP congestion control algorithm.
> set ns tcpProfile profile1 -flavor Westwood
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Dynamic receive buffering
Enable dynamic receive buffering on the required TCP profile.
> set ns tcpProfile profile1 -dynamicReceiveBuffering ENABLED
Done
> set lb vserver lbvserver1 -tcpProfileName profile1
Done
Support for TCP Fast Open (TFO) in Multipath TCP (MPTCP)
A Citrix ADC appliance now supports TCP Fast Open (TFO) mechanism for establishing Multipath TCP (MPTCP) connections and speed up data transfers. The mechanism allows subflow data to be carried during the initial MPTCP connection handshake in SYN and SYN-ACK packets and also enables data to be consumed by the receiving node during the MPTCP connection establishment.
For more information, see TCP Fast Open topic.
Support for Variable TFO Cookie Size for MPTCP
A Citrix ADC appliance now enables you to configure a variable length TCP Fast Open (TFO) cookie of a minimum size of 4 bytes and a maximum size of 16 bytes in a TCP profile. By doing this, the appliance can respond with the configured TFO cookie size in the SYN-ACK packet to the client.
To configure TCP Fast Open (TFO) cookie in a TCP profile by using the command line interface
At the command prompt, type:
set tcpProfile nstcp_default_profile -tcpFastOpenCookieSize <positive_integer>
Example
set tcpProfile nstcp_default_profile -tcpFastOpenCookieSize 8
To configure TCP Fast Open (TFO) cookie in a TCP profile by using GUI
- Navigate to Configuration > System > Profiles.
- In the details pane, go to TCP Profiles tab and select a TCP profile.
- In the Configure TCP Profile page, set the TCP Fast Open cookie size.
- Click OK and Done.
SYN-Cookie timeout interval
In a Citrix ADC appliance, by default, the SYN cookie parameter on the TCP profile is enabled to resist SYN attacks. If you prefer to detect an attack for a virtual server and check the SYN-ACK retransmission rate, the SYN cookie value is toggled from Enabled to Disabled state. However, the toggling effect of the cookie from Enabled to Disabled state and vice versa causes a configuration inconsistency between nodes in a cluster deployment. To overcome this, you can use the second SYN cookie parameter maintained on each virtual server of the appliance. When a SYN attack is detected, the SYN cookie on the TCP profile is disabled and the second SYN cookie value on the server is toggled from Disabled to Enabled state. The cookie remains in Enabled state for a autosyncookietimeout interval that you can specify. During the timeout interval, the virtual server fights the SYN attack in SYN Cookie mode. After the interval times out, the SYN Cookie value is toggled back to Disabled state if the virtual server’s SYN-ACK retransmission rate is below the threshold. Otherwise, if the rate is still above the threshold, it implies it is a SYN attack and the cookie is again toggled to Enabled state for the specified timeout period.
To configure the maximum SYN ACK retransmission threshold by using the command line interface
At the command prompt, type:
set ns tcpparam [-maxSynAckRetx <positive_integer>]
Set ns tcpparam [-maxSynAckRetx 150]
To configure auto SYN cookie timeout interval by using the command line interface
At the command prompt, type:
set ns tcpparam [-autosyncookietimeout <positive_integer>]
Set ns tcpparam [-autosyncookietimeout 90]