> unfortunately the management vlan my nsip is on is routable via internal data vlans so i cant restrict access to the nsip from select jump off boxes via firewall. I got to use ACL's NetScaler side what i am looking to do is restrict access to 443/80/22 from everywhere apart from the jump off box. I only have management access enabled on the NSIP none of the SNIPs have it enabled. Is it a case of just applying the attached config? These are in a HA pair and i use netscaler console service agent do i have to add acl rules for HA communication ports ? SNMP/ for console service what about outbound NSIP access to DNS/AD ect

I would set the deny ACLs higher, just to make sure they were read last.

with the above every else works HA comms, GSLB comms, NSIP outbound monitor probes/DNS/LDAP (if not using Vservers) ?

Did you set the implicit allow ACL to disabled too? set l3param -implicitACLAllow DISABLED My understanding is that for it to block SSH/22 traffic that will need to be set to disabled, but isn't needed for http and https.

I have left that set to enabled. I have a deny rule for ssh. I tested ssh and from non jump off box ssh doesn't work but from jump off box it does so appears to be working and I see hits on the deny ssh acl

This is the advice I'm following on that. AI Overview (Google): "Yes, you should keep set l3param -implicitACLAllow ENABLED. "This setting ensures that critical internal system communications (such as high-availability heartbeats, internal cluster synchronization, and control channel commands) bypass your Access Control Lists (ACLs). Setting this parameter to DISABLED risks breaking your High Availability (HA) sync or bricking appliance communications entirely. "The parameter implicitACLAllow does not allow general public web traffic to bypass your rules. It is specifically designed to safeguard traffic to internal ports (like TCP 3008-3011, UDP 3003, and cluster controls)."