Corporate Headquarters

Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

Software Release 2.1(1)

May, 2005

Cisco Systems, Inc.

170 West Tasman Drive San Jose, CA 95134-1706

USA http://www.cisco.com Tel: 408 526-4000

800553-NETS (6387)

Fax: 408 526-4100

Text Part Number: OL-7029-01

Page 1

Image 1

Cisco Systems manual Corporate Headquarters, Text Part Number OL-7029-01

Contents

Text Part Number OL-7029-01 Corporate HeadquartersPage Iii N T E N T S Hw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Vii Show module csm static server Viii Vlan virtual server submode Ssl-proxy policy url-rewrite Acronyms A-1 Organization AudienceChapter Title Description Convention Description ConventionsBoldface font Boldface Obtaining Documentation Related DocumentationXiii Cisco Product Security Overview Documentation FeedbackCisco Ordering tool Cisco Marketplace Xiv An emergency, you can also reach Psirt by telephone 877 408 Obtaining Technical Assistance Xvi Submitting a Service Request Xvii Obtaining Additional Publications and Information Xviii Command Task Using Content Switching Module Commands # prompt is displayed Command Modes Regular Expressions Submodes When you are in a submode, the prompt changes toExpression Meaning Zero or more characters Backspace Ascii Alert AsciiForm-feed Ascii Newline Ascii Content Switching Module with SSL Commands Arp Defaults Command Modes Command HistoryVlan id Release Modification Command Modes Command History Syntax Description DefaultsCapp udp Capp udp No capp udp Related Commands port Capp UDP submode Options Capp UDP submode Related Commands capp udpNo options ipaddress Encryption MD5 Port Capp UDP submode This example shows how to set the port for Capp connectionsPort portnum no port Capp udp Secure No secure Secure Capp UDP submode Clear module csm Password No dfp password passwordDfp Related Commands show module csm dfp Dfp Agent DFP submodeManager DFP submode Show module csm dfp Manager DFP submode Syntax Description Defaults Command ModesManager port No manager Agent DFP submode Exit Exit Ft group Module CSM configuration submodeFt group group-id vlan vlan number No ft group Heartbeat-time fault tolerant submode Failover fault tolerant submodePreempt fault tolerant submode Priority fault tolerant submode Failover failover-time Failover fault tolerant submodeNo failover Ft group Heartbeat-time heartbeat-timeno heartbeat-time Heartbeat-time fault tolerant submodeFt group Show module csm ft Related Commands ft group Preempt fault tolerant submodePreempt No preempt Priority value alt value No priority Alt Priority fault tolerant submodeCSM Value Preempt fault tolerant submode Track fault tolerant submode Hw-module csm slot standby config-sync Hw-module csm standby config-syncSyntax Description Defaults Command Modes Command History Ip address Vlan submode priority fault tolerant submode Ip slb mode csm rp no ip slb mode Csm Ip slb modeOn the Catalyst 6500 series switch Keyword to select the route processor Cisco IOS SLB mode Module csm Show ip slb mode Cookie Map cookieCookie-map policy submode Match protocol http cookie cookie map submode Cookie-value Match protocol http cookie cookie map submodeMap cookie Show module csm map This example shows how to group DNS domains DNS domains can be configured to a mapMap dns Match protocol dns domain DNS map submode This example shows how to add domains to a DNS map SLB DNS map configuration submodeMatch protocol dns domain DNS map submode Name Names the DNS domain being mapped Map name header no map name Map headerHeader-map policy submode Insert protocol http header header map submode Header-value value Insert protocol http header header map submodeHeader-map policy submode map header Show module csm map Match protocol http header header map submode SLB header map configuration submodeHeader-value expression Must be matched This command has no default settings CSM module submode Keyword to enter the return error code map submodeMap retcode Map name retcode No map name Match protocol http retcode return code map submode Map retcode SLB policy configuration submodeAction count Action log Map url-map-name url no map url-map-name Map urlUrl-map-name Match protocol http url URL map submode Usage Guidelines Examples Related Commands SLB URL map configuration submodeMatch protocol http url URL map submode Map url Show module csm map url-map policy submode Ip slb mode Slot-number Slot number where the CSM residesModule csm Module csm slot-number No module csm slot-number Netmask netmask Natpool module CSM submodeNat client serverfarm submode Show module csm natpool Variable module CSM submode Name Default Valid Values DescriptionVariable name value no variable name Noresetunidirectionalflows AggregatebackupsfstatetovSwitchoverrpaction Advertiserhifreq Show module csm variable Owner name no owner OwnerBilling-info owner submode Contact-info owner submode Maxconns owner submode Billing-infobilling-address-information Billing-info owner submodeNo billing-info Contact-info owner submode Contact-info string no contact-info Contact-info owner submodeString Owner’s information Maxconns number no maxconns Maxconns owner submodeNumber Number of maximum connections to the owner object Accept further connections Policy All policies should be configured with a server farmPolicy policy-name no policy policy-name Show module csm owner Client-group policy submode Ip access-list standardNo client-group Policy Show module csm owner Cookie-mapcookie-map-name Cookie-map policy submodeNo cookie-map Map cookie Header-map policy submode Specified in the map header commandHeader-map name No header-map Map header No nat client Nat client policy submodeStatic Natpool module CSM submode Serverfarm policy submode Serverfarm virtual server submode Policy Set ip dscp policy submode Default is that the CSM does not store Dscp valuesSet ip dscp dscp-valueno set ip dscp Dscp-value Range is from 0 to Sticky-group policy submode This example shows how to configure a sticky groupSticky-group group-id No sticky-group Show module csm owner Show module csm sticky Sticky Url-map policy submode Default is no URL mapUrl-mapurl-map-name no url-map Map url Probe Show module csm probe Probe No address ip-address Address probe submodeRouted Probe SLB Http probe configuration submode Credentials username passwordThis command is for Http probes Credentials probe submode Description line No description Description serverfarm submodeLine Description text Expect status probe submode Enter the no expect status 34 99 command Related Commands probe This command is used for all probe types Default value for the failed interval is 300 secondsFailed probe submode Failed failed-interval no failed Header field-name field-value Header probe submodeNo header field-name Probe Show module csm probe Interval seconds no interval Interval probe submode Name probe submode SLB DNS probe configuration submodeName domain-name no name Default value for the open timeout is 10 seconds Open open-timeout no openSLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Open probe submode Port probe submode Default value for the port number isPort port-number no port Port-number Sets the port number Default value for a receive timeout is 10 seconds Receive receive-timeout no receiveThis command is available for all probe types except TCP Receive probe submode Recover recovervalue no recover Recover probe submodeDefault value is This command is available for all probe types Method get Request probe submodeMethod head Url path Retries probe submode Default value for retries isRetries retry-count no retries Script scriptname Script probe submodeScriptname Specifies a probe script Failed probe submode SLB serverfarm configuration submode Default is no port translation for the real serverReal Real ip-address port local No real ip-address port Cat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Backup real ip name name port no backup real Backup real real server submodeName name Failaction serverfarm submode Health probe probe-nametag string Health probe real server submodeNo health probe Tag Inservice standby No inservice Standby Inservice real server submodeCommand History Release Modification Real Show module csm real Maxconns max-conns no maxconns Maxconns real server submodeReal server falls below Minconns Minconns real server submode Minconns real server submode Default value is the set minumum number of connectionsMinconns min-consno minconns Maxconns real server submode real Show module csm real Redirect-vserver name no redirect-vserver Redirect-vserver real server submodeTraffic is not redirected to the server Weight weighting-value no weight Weight real server submodeWeighting value default is Predictor serverfarm submode Redirect-vserver This example shows how to name the virtual serverRedirect-vserver name no redirect-vserver name Advertise active no advertise Advertise redirect virtual server submodeActive Advertise virtual server submode Client redirect virtual server submode SLB redirect virtual server configuration submodeExclude Optional Specifies that the IP address is disallowed Idle duration Idle redirect virtual server submodeNo idle Redirect-vserver real server submode Inservice No inservice Inservice redirect virtual server submodeRedirect-vserver Show module csm vserver redirect Replicate csrp No replicate csrp Replicate csrp redirect virtual server submodeVserver No ssl Ssl redirect virtual server submodeHttps Ftp No virtual vipaddress Virtual redirect virtual server submodeRedirect-vserver real server submode Show module csm vserver redirect Show module csm sticky Vlan redirect virtual server submodeSticky Sticky-group policy submode Webhost backup backup-string301 No webhost backup Webhost backup redirect virtual server submode301 302 Webhost relocation redirect virtual server submode Reverse-sticky group-idno reverse-sticky Reverse-stickySticky Sticky-group policy submode No script file Script file Related Commands show module csm script 100 Script taskScript name Show module csm script Serverfarm serverfarm-name No serverfarm serverfarm-name Serverfarm Bindid serverfarm submode SLB serverfarm configuration submodeBindid bind-idno bindid Dfp This example shows how to add a description CSM release This command was introducedCat6k-2config-slb-sfarm#description Backup Server Farm Failaction serverfarm submode Backup real real server submodeFailaction purge reassign No failaction purge reassign Purge Dfp Script task Show module csm serverfarm Health serverfarm submode100 Nat client client-pool-name static Nat client serverfarm submode101 Nat server source-macno nat server Nat server serverfarm submodeSource-mac 102 103 Predictor serverfarm submode 104 105 106 Probe serverfarm submode Retcode-mapretcodemapname no retcode-map Retcode-map serverfarm submodeMap retcode Script task Show module csm serverfarm Show module csm This example shows how to display static dataReal static NAT submode Static Related Commands arp Mode rp onlyShow module csm arp Show module csm slot arp Show module csm capp udp details Show module csm cappSyntax Description 110 111 State Explanation Show module csm conns112 Synsrv Related Commands module csmReqwait 113 Show module csm dfp WeightsAgent Manager 115 Show module csm ft Mode rp onlyShow module csm slot ft detail 116 Url Show module csm mapHeader Name Related Commands map cookie This example shows how to display return code mapsMap header map url module csm 118 Show module csm slot memory vserver vserver-name detail Show module csm memoryParse-length virtual server submode 119 Show module csm natpool Ip slb mode rp onlyShow module csm slot natpool name pool-name detail Natpool module CSM submode Show module csm slot owner name owner-name detail Show module csm ownerOwner virtual server submode 121 Show module csm policy Slb mode rp onlyShow module csm slot policy name policy-name 122 123 Show module csm probe 124 Probe serverfarm submode Show module csm slot probe script name probe-name detail Show module csm probe scriptProbe serverfarm submode script probe submode 125 Show module csm slot pvlan Show module csm pvlan126 Cat6k-2#show module csm 4 pvlan Show module csm slot real sfarm sfarm-name detail Show module csm realSfarm This example shows Cisco IOS SLB real server data 128 Field Description Show module csm slot real retcode sfarm sfarm-name detail Show module csm real retcode129 Cat6k-2#show module csm 5 real retcode Show module csm slot script name fullfileURL code Show module csm scriptCode 130 Show module csm script task This example shows how to display a running scriptShow module csm slot script task index script-index detail Index Show module csm serverfarm For ip slb mode rp onlyShow module csm slot serverfarm name serverfarm-name detail 132 Redirect Bind id Field133 Cat6k-2#show mod csm 5 serverfarm detail Drop Show module csm staticNat Virtual Pass-through Show module csm static server135 136 Real static NAT submode static Show module csm stats This example shows how to display SLB statisticsShow module csm slot stats Statistics counters are 32-bit 138 3describes the fields in the display Show module csm status This example shows how to display CSM statusShow module csm slot status 139 Show module csm slot sticky groups client ipaddress Show module csm stickyGroups 140 Sticky Sticky virtual server submode 4describes the fields in the display141 Show module csm slot tech-script Show module csm tech-script142 Cat6k-2#show module csm 4 tech-script 143 Show module csm tech-support Cat6k-2#show module csm 4 tech-support processor 144 145 Show module csm variable Variable commandShow module csm slot variable name name detail 146 147 Csm slot variable detail commandCat6k-2#show module csm 5 variable detail Client Show module csm vlanServer Vlan-id 149 Related Commands vlan virtual server submode This example shows how to display the CSM virtual servers Redirect for ip slb mode rp onlyShow module csm vserver redirect Show module csm slot vserver redirect 151 Related Commands xml-config This example shows how to display the CSM XML statisticsShow module csm xml stats Show module csm xml stats Snmp enable traps slb ft no snmp enable traps slb ft Snmp enable traps slb ftActive after detecting a failure in its fault tolerant peer This example shows how to enable fault tolerant traps Nat client serverfarm submode StaticShow module csm static 154 Real static NAT submode SLB static NAT configuration submodeShow module csm static Static 156 Sticky Routerconfig-module-csm#variable Notimeoutipstickyentries Cat6k-2config-module-csm#sticky 5 header headername timeout157 No cookie offset Cookie offset sticky submodeOffset offset Length length Cookie secondary sticky submode This example shows how to specify a secondary sticky entryCookie secondary name no cookie secondary Name Specifies a cookie name Header offset value length value Header sticky submodeOffset value Length value 161 Static sticky submode 162 Vserver Server as host route Advertise virtual server submodeRedirect-vserver 163 Client virtual server submode Ip access-list standard164 Cat6k-2config-slb-vserver#description Backup Server Farm Related Commands vserverDescription virtual server submode 165 Domain virtual server submode This example shows how to set a domain name166 Idle virtual server submode This example shows how to specify an idle timer duration167 Virtual server is not in service Inservice virtual server submode168 No owner maxconns Owner virtual server submodeMaxconns Advertise virtual server submode Parse-length virtual server submode Default is SLB virtual server configuration submodeParse-length bytes No parse-length Bytes Number of bytes the range is from 1 to Default pending timeout is 30 seconds Pending timeout no pendingPending virtual server submode 171 Persistent rebalance virtual server submode This example shows how to enable the Http 1.1 persistencePersistent rebalance No persistent rebalance 172 Sticky Replicate csrp virtual server submodeConnection 173 Reverse-sticky group-id No reverse-sticky Reverse-sticky virtual server submode174 Threshold outservice realvalue inservice realvalue options BackupServerfarm command Serverfarm virtual server submode Serverfarm policy submode Command176 Slb-policypolicy-name priority priorityvalue Slb-policy virtual server submodeNo slb-policy policy-name 177 Ssl-sticky offset X length Y No ssl-sticky Ssl-sticky virtual server submodeOffset Length Status-tracking vservername Status-tracking virtual server submodeVservername Identifies the dependent virtual server 179 180 Sticky virtual server submode Reverse-sticky virtual server submode For connection coupling181 Default No default unidirectionalRelated Commands show module csm vserver redirect Unidirectional virtual server submode Predictor serverfarm submode Url-hash virtual server submode183 184 Virtual virtual server submode 185 186 No vlan Vlan virtual server submodeShow module csm vlan Vlan virtual server submode 187 Vlan vlan-numberclient server No vlan VlanClient server 188 Alias ip-address netmask No alias ip-address netmask Alias Vlan submodeVlan Netmask 190 Related Commands show module csm vlan vlan XML submode Description Vlan submode Ip address Vlan submode SLB Vlan configuration submode191 Gateway ip-addressno gateway ip-address Gateway Vlan submodeShow module csm vlan Vlan virtual server submode 192 No ip address Ip address Vlan submodeAlt 193 Gateway Route Vlan submodeGw-ip-address 194 Xml-config no xml-config Xml-configClient-group XML submode Credentials XML submode Vlan XML submode Client-group XML submode Xml-configClient-group 1-99name 196 Credentials XML submode Credentials user-name passwordNo credentials user-name Client-group XML submode Defaults Command Modes Inservice XML submodeThis example shows how to enable XML Xml-config Port port-number Port XML submodeNo port Port-number Sets the CSM port Vlan id no vlan Vlan XML submodeVlan name All VLANs are accepted Commands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy vlan Ssl-proxy service Service name Clear ssl-proxy conn service nameSsl-proxy connection command without options Clear ssl-proxy conn Clear ssl-proxy session Clear ssl-proxy session service name Clear ssl-proxy stats Terminal Crypto ca export pemDes 3des Importing CA certificate Exportable Crypto ca import pemUsage-keys Crypto ca export pem Tftp Crypto ca export pkcs12Pkcs12filename Page Crypto ca import pkcs12 Filename TP2? /users/admin-1/pkcs12/TP2.p12 This example shows how to import a PKCS12 file using SCPCrypto Keylabel Name of the key Crypto key export rsa pemOptional Specifies that the key can be exported Key nametest-keys UsageGeneral Purpose Key Instead of one general-purpose key pair Crypto key import rsa pemNull-Imports from the null file system System-Imports from the system file system Examples Debug ssl-proxy This example shows how to turn on FDU debugging This example shows how to turn on App debuggingThis example shows how to turn on IPC debugging This example shows how to turn on PKI debugging This example shows how to turn off TCP debugging This example shows how to turn on TCP debuggingSsl-proxy#debug ssl-proxy tcp Ssl-proxy#no debug ssl-proxy tcp Command EXEC-level command to be executed Do commandConfiguration mode Show ssl-proxy admin-info Show ssl-proxy admin-infoSsl-proxy#show ssl-proxy admin-info Show ssl-proxy buffers This command has no default settingsShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffers Service name Show ssl-proxy certificate-history service nameOptionally for a specific proxy service Show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31 Ssl-proxy# show ssl-proxy certificate-history Related Commands ssl-proxy service Show ssl-proxy conn Show ssl-proxy conn service name4tuple Remote Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Show ssl-proxy crash-info brief details Show ssl-proxy crash-infoBrief Limited to processor registers Ssl-proxy#show ssl-proxy crash-info brief Stack top Printing 1024 bytes from stack top Show ssl-proxy mac address Show ssl-proxy mac addressModule with SSL Ssl-proxy#show ssl-proxy mac address Show ssl-proxy natpool name Show ssl-proxy natpoolName Optional NAT pool name Ssl-proxy#show ssl-proxy natpool NP1 Show ssl-proxy policy http-header ssl tcp url-rewrite name Show ssl-proxy policyHttp-header Url-rewrite MSS Show ssl-proxy service name Show ssl-proxy serviceName Optional Service name Ssl-proxy#show ssl-proxy service Proxy status No Client VLAN, No Server Vlan Ssl-proxy# Show ssl-proxy stats type Show ssl-proxy statsStats Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage Counters This example shows how to display the PKI statistics Ssl-proxy# show ssl-prox stats fdu This example shows how to display the FDU statistics Show ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Show ssl-proxy version Show ssl-proxy versionSsl-proxy#show ssl-proxy version Show ssl-proxy vlan vlan-iddebug Show ssl-proxy vlanDebug Optional Displays debug information Show ssl-proxy vts This command has no default settings Exec modeSsl-proxy#show ssl-proxy vlan Defaults Command Modes Command History Examples Snmp-server enable This example shows how to start a cryptographic self-test Seconds Global configurationSsl-proxy crypto selftest Time-interval Ssl-proxy mac address Related Commands show ssl-proxy mac addressSsl-proxy mac address mac-addr Related Commands show ssl-proxy natpool This example shows how to define a pool of IP addressesSsl-proxy natpool Ssl-proxy pki This example shows how to enable PKI event-history This example shows how to specify the cache sizeRelated Commands show ssl-proxy stats Ssl-proxy policy http-header http-header-policy-name Ssl-proxy policy http-headerHttp-header-policy-name Http header policy name Custom custom-string Ssl-proxy policy ssl Timeout session timeout absoluteSsl-proxy policy ssl ssl-policy-name Ssl-policy-name SSL policy name Default cipher close-protocol RSAWITHRC4128SHA all No close-protocol enableNo session-cache enable Timeout handshake timeout This example shows how to disable session-cache This example shows how to enable session-cacheSsl-proxy config# ssl-proxy policy ssl sslpl1 Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHA This example shows how to print out a help Timeout reassembly is 60 seconds Defaults are as followsSsl-proxy policy tcp Ssl-proxy policy tcp tcp-policy-name No timeout reassembly time No timeout syn timeout-in-secondsNo buffer-share rx buffer-limit-in-bytes No buffer-share tx buffer-limit-in-bytes Related Commands show ssl-proxy policy Ssl-proxy policy url-rewrite url-rewrite-policy-name Ssl-proxy policy url-rewrite Ssl-proxyconfig-url-rewrite-policy# Ssl-proxy config# ssl-proxy policy url-rewrite test1 Ssl-proxy pool ca This command has no arguments or keywordsSsl-proxy pool ca-pool-name Ca-pool-name Certificate authority pool name Ssl-proxy service ssl-proxy-nameclient Ssl-proxy serviceSsl-proxy service client command Protocol protocol port portno subcommand Default certificate inservice nat server Authenticate verify all signature-onlyInservice Certificate rsa general-purpose trustpoint Ssl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Exits from proxy-client configuration submode Ssl-proxy service clientDeclares a proxy client as administratively up Ssl-proxy config# ssl-proxy service S7 client Sslv2 keyword enables SSL versionApplies a URL rewrite policy to the proxy server Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxy config# no ssl-proxy ssl ratelimit Ssl-proxy config# ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxyy ssl ratelimit Ssl-proxy vlan AdminSsl-proxy vlan vlan Gateway prefix drop forward1 Standby delay minimum reload Standby authenticationStandby ip Standby mac-address Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gateway Ssl-proxyconfig-vlan#ipaddr 208.59.100.18Ssl-proxyconfig-vlan#ipaddr 10.1.0.20 Related Commands show ssl-proxy vlan Group-number is String is cisco Standby authentication Min-delay is 1 second Reload-delay is 5 seconds Standby delay minimum reload Ssl-proxyconfig-vlan#standby delay minimum 30 reload Show standby delay Proxy-VLAN configuration submode Hsrp is disabled by defaultStandby ip Secondary Used by the hot standby group is learned using Hsrp Standby group-numbermac-addressmac-address Standby mac-addressNo standby group-numbermac-address Mac-address MAC address That is used in the end nodes Ssl-proxyconfig-vlan#standby 1 mac-addressShow standby Standby mac-refresh seconds no standby mac-refresh Standby mac-refresh Standby name Hsrp is disabledStandby name group-name No standby name group-name Group-name Specifies the name of the standby group Minimum delay DelayReload delay Sync delay Leaves any synchronization delay if it was configured Operation returns to the default behaviorSsl-proxyconfig-vlan#standby preempt delay minimum Clients Standby priority This example shows how to change the router priorityStandby group-numberpriority priority No standby group-numberpriority priority Standby track Disable EnableTimers Standby redirects Ssl-proxyconfig-vlan#standby redirects timers 90 Related Commands show standbyShow standby redirect Msec Standby timers Interface ethernet Standby track Command commands and take action when the object changesDecrement priority Back up Router B Configuration Router a ConfigurationRelated Commands standby preempt Standby priority Standby use-bia scope interface No standby use-bia Standby use-biaScope interface OL-7029-01 Acronym Expansion CCA CbacCDP CEF Dsap DramDscp Dspu Icmp ICDIDB IDP Mdix MD5Mdss MFD OSM OSIOspf PAE ROM RmonRommon RPC SVC STPSVI TACACS+ WRR Weighted round-robinXNS Xerox Network System OL-7029-01 Http Capp UDPCapp IN-1 XML NATIN-2 IN-3 FTP See FTPGslb IN-4 IN-5 Secondary interface Pool addresses ConfigurationIN-6 IN-7 Gslb Http IN-8 Real server Backup Enabling IN-9 Smtp URL TCPIN-10 IN-11 IN-12 Credentials Enabling Port Statistics display Vlan