A Citrix Administrator needs to configure a rate-limiting policy setting DNS requests to a threshold of 1,000 per second. Which command does the administrator need to run to correctly configure this policy?

The SYS.CHECK.LIMIT(limitidentifier) expression is the standard function used in Citrix ADC policies to enforce rate limiting. The administrator first defines a limit identifier that specifies the traffic selector, the threshold (e.g., 1,000), and the time slice (e.g., 1 second). Then, a policy (such as a responder or rewrite policy) is created with a rule that uses the SYS.CHECK.LIMIT() function. When this policy is bound, the function evaluates incoming requests against the defined limit identifier. If the rate is exceeded, the policy's associated action is triggered. This mechanism is generic and applies to any traffic type, including DNS, identified by the policy rule.

A. HTTP.REQ.LIMIT(): This is not a valid Citrix ADC policy expression. Rate limiting for HTTP traffic is configured using a limit identifier and the standard SYS.CHECK.LIMIT() function.
C. SYS.CHECK.LIMIT() || CONNECTION.IP.LIMIT(): CONNECTION.IP.LIMIT() is not a valid Citrix ADC policy expression. The logical OR (||) operator is also unnecessary for the stated requirement.
D. SYS.CHECK.LIMIT() || HTTP.REQ.LIMIT(): This expression incorrectly combines the valid rate-limiting function with an invalid function using a logical OR, which is not required for a DNS-specific policy.

1. Citrix ADC 13.1 Documentation

"Rate limiting": This document outlines the entire process of configuring rate limiting. It specifies that a policy is used to select the traffic and that the policy expression invokes the rate limiting functionality. The examples consistently show the use of SYS.CHECK.LIMIT(identifier) within the policy rule.

Reference: In the section "Configure rate limiting"

Step 4 describes creating a policy with an expression. The core of this expression is SYS.CHECK.LIMIT().

2. Citrix ADC 13.1 Documentation

"Policy Expressions

" "Miscellaneous Expressions": This section explicitly lists and describes the SYS.CHECK.LIMIT(limitIdentifierName) function.

Reference: Under the "Miscellaneous Expressions" subsection

the function SYS.CHECK.LIMIT(limitIdentifierName) is defined as: "Checks whether the traffic rate has reached the configured limit." This confirms it is the correct function for this purpose.

3. Citrix ADC 13.1 Documentation

"DNS Rate Limiting": This document provides a specific use case for rate limiting DNS requests

which is the scenario in the question. The configuration examples demonstrate creating a limit identifier for DNS and then using a responder policy with the SYS.CHECK.LIMIT() expression to enforce it.

Reference: In the section "To configure DNS rate limiting by using the CLI

" the example command add responder policy dnsrlpol "dns.req.isvalid && sys.checklimit(\"dnsrlli\")" RESET clearly shows sys.checklimit as the function used to enforce the DNS rate limit.