Cisco Systems 6500 guide

Chapter 2 Commands for the Catalyst 6500 Series SSL Services Module

service client

Examples

This example shows how to enter the client proxy-service configuration submode:

ssl-proxy (config)# ssl-proxy context s1 ssl-proxy(config-context)#service S7 client ssl-proxy(config-ctx-ssl-proxy)#

This example shows how to configure the certificate for the specified SSL-proxy services:

ssl-proxy(config-ctx-ssl-proxy)#certificate rsa general-purpose trustpoint tp1

ssl-proxy (config-ctx-ssl-proxy)#

These examples show how to set a specified command to its default value:

ssl-proxy (config-ctx-ssl-proxy)# default certificate ssl-proxy (config-ctx-ssl-proxy)# default inservice ssl-proxy (config-ctx-ssl-proxy)# default nat ssl-proxy (config-ctx-ssl-proxy)# default server ssl-proxy (config-ctx-ssl-proxy)# default virtual ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure a virtual IP address for the specified virtual server:

ssl-proxy(config-ctx-ssl-proxy)#virtual ipaddr 207.59.100.20 protocol tcp port 443

ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure the SSL policy for the specified virtual server:

ssl-proxy (config-ctx-ssl-proxy)# virtual policy ssl sslpl1

ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure the TCP policy for the specified virtual server:

ssl-proxy (config-ctx-ssl-proxy)# virtual policy tcp tcppl1 ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure a clear-text web server for the SSL Services Module to forward the decrypted traffic:

ssl-proxy(config-ctx-ssl-proxy)#server ipaddr 207.50.0.50 protocol tcp port 80

ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure a TCP policy for the given clear-text web server:

ssl-proxy (config-ctx-ssl-proxy)# server policy tcp tcppl1

ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to configure a NAT pool for the client address that is used in the server connection of the specified service SSL offload:

ssl-proxy (config-ctx-ssl-proxy)# nat client NP1 ssl-proxy (config-ctx-ssl-proxy)#

This example shows how to enable a NAT server address for the server connection of the specified service SSL offload:

ssl-proxy (config-ctx-ssl-proxy)# nat server ssl-proxy (config-ctx-ssl-proxy)#

Related Commands show ssl-proxy service

Catalyst 6500 Series Switch SSL Services Module Command Reference

2-58	OL-9105-01

Image 84

Cisco Systems 6500 manual Ssl-proxy config-ctx-ssl-proxy# server policy tcp tcppl1

Contents

Corporate Headquarters Text Part Number OL-9105-01Page N T E N T S Iii Natpool Acronyms A-1 OL-9105-01 Audience OrganizationRelated Documentation Chapter Title Description Conventions Convention DescriptionBoldface font Example, interface interface type Obtaining Documentation Cisco.com Documentation Feedback Cisco Product Security Overview Reporting Security Problems in Cisco Products Obtaining Technical Assistance Submitting a Service Request Xii Obtaining Additional Publications and Information Xiii Xiv Getting Help This chapter includes the following sections How to Find Command Options Command Comment Must enter next on the command line Mode keywordAfter you enter the mode keyword Complete the command. If additional Understanding Command Modes Command Mode Access Method Prompt Exit MethodConfigure terminal privileged Exec Configure terminal Using the No and Default Forms of Commands Interface commandImage using the boot system flash filename With an interface Using the CLI String Search Character Special Meaning \$ \ \+ AeiouAbcdABCD DA-D Telebit 3107 v32bis CharacterBa?b This string matches any number of asterisks Za-z0-9+ Codex telebitAbcd $\.12 For example 13001300$ 1300space space1300 1300, ,1300, 1300 ,1300 With OL-9105-01 A P T E R Defaults Command Modes Command HistoryClear ssl-proxy conn Release Modification Clear ssl-proxy content Defaults Command Modes Command History Clear ssl-proxy session Usage Guidelines Clear ssl-proxy stats Ssl-proxy#clear ssl-proxy stats Crypto pki export pem TerminalDes 3des Related Commands Crypto pki import pem Defaults Command History Crypto pki import pemExportable Usage-keys Crypto pki export pem Crypto pki export pkcs12 This example shows how to export a PKCS12 file using SCP Crypto pki import pkcs12 This example shows how to import a PKCS12 file using SCP Filename TP2? /users/admin-1/pkcs12/TP2.p12Crypto Crypto key decrypt rsa Name key-namePassphrase passphrase Crypto key encrypt rsa Crypto key encrypt rsa Crypto key decrypt rsaCrypto key lock rsa Crypto key export rsa pem Keylabel Name of the keyOptional Specifies that the key can be exported Key nametest-keys UsageGeneral Purpose Key Crypto key import rsa pem Instead of one general-purpose key pairNull-Imports from the null file system System-Imports from the system file system PEM-formatted RSA key to the SSL Services Module Crypto key lock rsa Crypto key lock rsa name key-namepassphrase passphraseName key-name Optional Name of the key Passphrase passphrase Crypto key unlock rsa Crypto key unlock rsa name key-namepassphrase passphrase Debug ssl-proxy Command History Release Modification This example shows how to turn on App debugging Do command Command EXEC-level command to be executedConfiguration mode Syntax Description Defaults Command Modes Command History Interface ssl-proxySyntax Description Standby authentication Standby delay minimum reloadStandby timers Standby ip Ssl-proxy config# interface ssl-proxy Ssl-proxyconfig-subif#ip address 208.59.100.18 Context subcommand mode This example shows how to define a pool of IP addressesNatpool Natpool nat-pool-name startipaddr endipaddr netmask netmask Syntax Description Defaults Command Modes Policy health-probe tcpInterval seconds Failed-interval seconds Open-timeout seconds Ssl-proxyconfig#ssl-proxy context sslSsl-proxyconfig-context#policy health-probe tcp probe1 Running on server IP addressPage Policy http-header Client-cert pemAlias Policy that is applied to the payload Field To Insert Description Client-cert pem Client-ip-port Custom custom-stringInserts the custom-stringheader into the Http header Prefix Related Commands show ssl-proxy policy SSL-OFFLOAD-SOFTWARE VERSION3.11 Close-protocol is disabled Session-caching is enabledTimeout session timeout absolute Policy ssl SSL-Policy Configuration Submode Command Descriptions Renegotiation volume size Timeout handshake timeoutHelp Renegotiation interval time OL-9105-01 This example shows how to enable a session cache This example shows how to disable a session cache OL-9105-01 Policy tcp Delayed-ack-threshold delay Delayed-ack-timeout timerNo timeout fin-wait timeout-in-seconds No timeout inactivity timeout-in-seconds No timeout reassembly time Form of this command to return to the default settingNo tos carryover Server to client connection, the server connection must be Ssl-proxy config-ctx-tcp-policy# mss Policy url-rewrite Ssl-proxyconfig-context#ssl-proxy policy url-rewrite test1 Redirectonly Pool ca Pool ca ca-pool-nameCa-pool-name Certificate authority pool name Service Authenticate verify all signature-only Default certificate inservice nat serverInservice Certificate rsa general-purpose trustpoint Virtual policy ssl ssl-policy-name Virtual policy tcpVlan vlan Related Commands show ssl-proxy service Service client Policy health-probe tcp Policy http-header Nat server client natpool-name Virtual policy ssl ssl-policy-nameVirtual policy tcp Vlan vlan Ssl-proxy config-ctx-ssl-proxy# server policy tcp tcppl1 Show interfaces ssl-proxy Show interfaces ssl-proxy 0.subinterfacePolicy tcp Show ionterfaces This command has no default settings Show ssl-proxy buffersShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffers Show ssl-proxy certificate-history service name Service nameSpecific proxy service Show ssl-proxy certificate-history Ssl-proxy# show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31 Related Commands service Show ssl-proxy conn 4tupleLocal Remote Context name Module module Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Context Default Show ssl-proxy contextShow ssl-proxy context name Name Optional Name of the context Show ssl-proxy crash-info Show ssl-proxy crash-info brief detailsBrief Details Stack top Printing 1024 bytes from stack top Ssl-proxy#show ssl-proxy crash-info brief Show ssl-proxy mac address Show ssl-proxy mac addressSsl-proxy#show ssl-proxy mac address Show ssl-proxy natpool Show ssl-proxy natpool namecontext nameContext name Natpool Show ssl-proxy policy Health-probe tcpHttp-header Url-rewrite Ssl-proxy#show ssl-proxy policy ssl ssl-policy1 Ssl-proxy#show ssl-proxy policy tcp tcp-policy1 Ssl-proxy#show ssl-proxy policy health-probe tcp tcp-health Show ssl-proxy service Show ssl-proxy service namecontext nameSsl-proxy#show ssl-proxy service Ssl-proxy#show ssl-proxy service S6 Service client Content Show ssl-proxy statsShow ssl-proxy stats type Stats This example shows how to display the TCP statistics This example shows how to display the PKI statistics This example shows how to display context statistics Ssl-proxy#show ssl-proxy stats context Context name DefaultSsl-proxy# show ssl-proxy stats hdr This example shows how to display content statistics Ssl-proxy#show ssl-proxy stats content Show ssl-proxy status Show ssl-proxy status fdu ssl tcpShow ssl-proxy status TCP cpu is alive Show ssl-proxy version Show ssl-proxy versionSsl-proxy#show ssl-proxy version Show ssl-proxy vlan Show ssl-proxy vlan vlan-iddebugmodule moduleDebug Optional Displays debug information Snmp-server enable Defaults Command Modes Command History Examples Command Purpose and Guidelines Defaults Ssl-proxy contextSsl-proxy context name No ssl-proxy context name Description description Policy ssl policy-name Policy tcp policy-namePolicy url-rewrite policy-name Pool ca name Seconds Global configuration This example shows how to start a cryptographic self-testSsl-proxy crypto selftest Time-interval This example shows how to configure a MAC address Related Commands show ssl-proxy mac addressSsl-proxy config# ssl-proxy mac address 00e0.b0ff.f232 Ssl-proxy mac address Ssl-proxy pki This example shows how to specify the cache size This example shows how to enable PKI event-historyRelated Commands show ssl-proxy stats Ssl-proxy crypto key unlock rsa Key-name Name of the key Passphrase Pass phrase Time is 6 seconds Global configuration Ssl-proxyconfig#ssl-proxy ip-frag-ttlSsl-proxy ip-frag-ttl Ssl-proxy ip-frag-ttl time Ssl-proxy config# ssl-proxy ssl ratelimit Ssl-proxy config# no ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxy ssl ratelimit No ssl-proxy ssl ratelimit Standby authentication Group-number is String is cisco Standby delay minimum reload Min-delay is 1 second Reload-delay is 5 seconds Show standby delay Ssl-proxyconfig#interface ssl-proxySsl-proxyconfig-subif#standby delay minimum 30 reload Defaults Command Modes Command History Usage Guidelines Standby ipSecondary Group-number is Used by the hot standby group is learned using Hsrp 100 Standby mac-address Standby group-numbermac-addressmac-addressNo standby group-numbermac-address Mac-address MAC address Ssl-proxyconfig-subif#standby 1 mac-address That is used in the end nodesShow standby 102 Standby mac-refresh Standby mac-refresh seconds no standby mac-refresh103 Hsrp is disabled Standby nameStandby name group-name No standby name group-name Group-name Name of the standby group Standby preempt 105 Operation returns to the default behavior Leaves any synchronization delay if it was configuredClients To become the active router Standby priority Standby group-numberpriority priorityNo standby group-numberpriority priority Group-number is Priority is This example shows how to change the router priority 108 Standby redirects 109 Related Commands show standby Ssl-proxyconfig-subif#standby redirects timers 90Show standby redirect 110 Standby timers MsecOptional Specifies the interval in milliseconds 111 112 Standby track Decrement priorityOr comes back up 113 Router a Configuration Router B ConfigurationRelated Commands standby preempt 114 Standby use-bia Standby use-bia scope interface no standby use-biaScope interface On which it was entered, instead of the major interface This example shows how to configure Hsrp version Standby versionStandby version 1 Specifies Hsrp version Acronym Expansion Cbac CCACDP CEF Dram DsapDscp Dspu ICD IcmpIDB IDP MD5 MdixMdss MFD OSI OSMOspf PAE Rmon ROMRommon RPC STP SVCSVI TACACS+ Weighted round-robin WRRXNS Xerox Network System OL-9105-01 Acknowledgments for Open-Source Software OL-9105-01 # character privileged Exec mode prompt Asterisk + plus sign Period ? command Caret$ character IN-1 IN-2 IN-3 IN-4 TCP IN-5 Configuration submode User Exec mode, summary IN-6