115 | Cisco Systems OL-7029-01 specification

Chapter 2 Content Switching Module with SSL Commands

show module csm dfp

Related Commands agent (DFP submode) dfp

manager (DFP submode) module csm

	Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

OL-7029-01		2-115
OL-7029-01		2-115

Page 137

Image 137

Contents

Text Part Number OL-7029-01 Corporate HeadquartersPage Iii N T E N T S Hw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Vii Show module csm static server Viii Vlan virtual server submode Ssl-proxy policy url-rewrite Acronyms A-1 Chapter Title Description AudienceOrganization Convention Description ConventionsBoldface font Boldface Xiii Related DocumentationObtaining Documentation Cisco Product Security Overview Documentation FeedbackCisco Ordering tool Cisco Marketplace Xiv An emergency, you can also reach Psirt by telephone 877 408 Obtaining Technical Assistance Xvi Submitting a Service Request Xvii Obtaining Additional Publications and Information Xviii Command Task Using Content Switching Module Commands # prompt is displayed Command Modes Regular Expressions Submodes When you are in a submode, the prompt changes toExpression Meaning Zero or more characters Backspace Ascii Alert AsciiForm-feed Ascii Newline Ascii Content Switching Module with SSL Commands Arp Defaults Command Modes Command HistoryVlan id Release Modification Command Modes Command History Syntax Description DefaultsCapp udp Capp udp No capp udp Related Commands port Capp UDP submode Options Capp UDP submode Related Commands capp udpNo options ipaddress Encryption MD5 Port Capp UDP submode This example shows how to set the port for Capp connectionsPort portnum no port Capp udp Secure No secure Secure Capp UDP submode Clear module csm Dfp No dfp password passwordPassword Related Commands show module csm dfp Manager DFP submode Show module csm dfp Agent DFP submodeDfp Manager DFP submode Syntax Description Defaults Command ModesManager port No manager Agent DFP submode Exit Exit Ft group Module CSM configuration submodeFt group group-id vlan vlan number No ft group Heartbeat-time fault tolerant submode Failover fault tolerant submodePreempt fault tolerant submode Priority fault tolerant submode Failover failover-time Failover fault tolerant submodeNo failover Ft group Heartbeat-time heartbeat-timeno heartbeat-time Heartbeat-time fault tolerant submodeFt group Show module csm ft Preempt No preempt Preempt fault tolerant submodeRelated Commands ft group Priority value alt value No priority Alt Priority fault tolerant submodeCSM Value Preempt fault tolerant submode Track fault tolerant submode Hw-module csm slot standby config-sync Hw-module csm standby config-syncSyntax Description Defaults Command Modes Command History Ip address Vlan submode priority fault tolerant submode Ip slb mode csm rp no ip slb mode Csm Ip slb modeOn the Catalyst 6500 series switch Keyword to select the route processor Cisco IOS SLB mode Module csm Show ip slb mode Cookie Map cookieCookie-map policy submode Match protocol http cookie cookie map submode Map cookie Show module csm map Match protocol http cookie cookie map submodeCookie-value This example shows how to group DNS domains DNS domains can be configured to a mapMap dns Match protocol dns domain DNS map submode This example shows how to add domains to a DNS map SLB DNS map configuration submodeMatch protocol dns domain DNS map submode Name Names the DNS domain being mapped Map name header no map name Map headerHeader-map policy submode Insert protocol http header header map submode Header-map policy submode map header Show module csm map Insert protocol http header header map submodeHeader-value value Match protocol http header header map submode SLB header map configuration submodeHeader-value expression Must be matched This command has no default settings CSM module submode Keyword to enter the return error code map submodeMap retcode Map name retcode No map name Match protocol http retcode return code map submode Map retcode SLB policy configuration submodeAction count Action log Map url-map-name url no map url-map-name Map urlUrl-map-name Match protocol http url URL map submode Usage Guidelines Examples Related Commands SLB URL map configuration submodeMatch protocol http url URL map submode Map url Show module csm map url-map policy submode Ip slb mode Slot-number Slot number where the CSM residesModule csm Module csm slot-number No module csm slot-number Netmask netmask Natpool module CSM submodeNat client serverfarm submode Show module csm natpool Variable name value no variable name Name Default Valid Values DescriptionVariable module CSM submode Noresetunidirectionalflows AggregatebackupsfstatetovSwitchoverrpaction Advertiserhifreq Show module csm variable Owner name no owner OwnerBilling-info owner submode Contact-info owner submode Maxconns owner submode Billing-infobilling-address-information Billing-info owner submodeNo billing-info Contact-info owner submode String Owner’s information Contact-info owner submodeContact-info string no contact-info Maxconns number no maxconns Maxconns owner submodeNumber Number of maximum connections to the owner object Accept further connections Policy All policies should be configured with a server farmPolicy policy-name no policy policy-name Show module csm owner Client-group policy submode Ip access-list standardNo client-group Policy Show module csm owner Cookie-mapcookie-map-name Cookie-map policy submodeNo cookie-map Map cookie Header-map policy submode Specified in the map header commandHeader-map name No header-map Map header No nat client Nat client policy submodeStatic Natpool module CSM submode Serverfarm policy submode Serverfarm virtual server submode Policy Set ip dscp policy submode Default is that the CSM does not store Dscp valuesSet ip dscp dscp-valueno set ip dscp Dscp-value Range is from 0 to Sticky-group policy submode This example shows how to configure a sticky groupSticky-group group-id No sticky-group Show module csm owner Show module csm sticky Sticky Url-map policy submode Default is no URL mapUrl-mapurl-map-name no url-map Map url Probe Show module csm probe Probe No address ip-address Address probe submodeRouted Probe SLB Http probe configuration submode Credentials username passwordThis command is for Http probes Credentials probe submode Line Description text Description serverfarm submodeDescription line No description Expect status probe submode Enter the no expect status 34 99 command Related Commands probe This command is used for all probe types Default value for the failed interval is 300 secondsFailed probe submode Failed failed-interval no failed Header field-name field-value Header probe submodeNo header field-name Probe Show module csm probe Interval seconds no interval Interval probe submode Name domain-name no name SLB DNS probe configuration submodeName probe submode Default value for the open timeout is 10 seconds Open open-timeout no openSLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Open probe submode Port probe submode Default value for the port number isPort port-number no port Port-number Sets the port number Default value for a receive timeout is 10 seconds Receive receive-timeout no receiveThis command is available for all probe types except TCP Receive probe submode Recover recovervalue no recover Recover probe submodeDefault value is This command is available for all probe types Method get Request probe submodeMethod head Url path Retries retry-count no retries Default value for retries isRetries probe submode Script scriptname Script probe submodeScriptname Specifies a probe script Failed probe submode SLB serverfarm configuration submode Default is no port translation for the real serverReal Real ip-address port local No real ip-address port Cat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Backup real ip name name port no backup real Backup real real server submodeName name Failaction serverfarm submode Health probe probe-nametag string Health probe real server submodeNo health probe Tag Inservice standby No inservice Standby Inservice real server submodeCommand History Release Modification Real Show module csm real Maxconns max-conns no maxconns Maxconns real server submodeReal server falls below Minconns Minconns real server submode Minconns real server submode Default value is the set minumum number of connectionsMinconns min-consno minconns Maxconns real server submode real Show module csm real Traffic is not redirected to the server Redirect-vserver real server submodeRedirect-vserver name no redirect-vserver Weight weighting-value no weight Weight real server submodeWeighting value default is Predictor serverfarm submode Redirect-vserver name no redirect-vserver name This example shows how to name the virtual serverRedirect-vserver Advertise active no advertise Advertise redirect virtual server submodeActive Advertise virtual server submode Client redirect virtual server submode SLB redirect virtual server configuration submodeExclude Optional Specifies that the IP address is disallowed Idle duration Idle redirect virtual server submodeNo idle Redirect-vserver real server submode Redirect-vserver Show module csm vserver redirect Inservice redirect virtual server submodeInservice No inservice Vserver Replicate csrp redirect virtual server submodeReplicate csrp No replicate csrp No ssl Ssl redirect virtual server submodeHttps Ftp No virtual vipaddress Virtual redirect virtual server submodeRedirect-vserver real server submode Show module csm vserver redirect Sticky Sticky-group policy submode Vlan redirect virtual server submodeShow module csm sticky Webhost backup backup-string301 No webhost backup Webhost backup redirect virtual server submode301 302 Webhost relocation redirect virtual server submode Sticky Sticky-group policy submode Reverse-stickyReverse-sticky group-idno reverse-sticky No script file Script file Related Commands show module csm script 100 Script taskScript name Show module csm script Serverfarm serverfarm-name No serverfarm serverfarm-name Serverfarm Bindid serverfarm submode SLB serverfarm configuration submodeBindid bind-idno bindid Dfp Cat6k-2config-slb-sfarm#description Backup Server Farm CSM release This command was introducedThis example shows how to add a description Failaction serverfarm submode Backup real real server submodeFailaction purge reassign No failaction purge reassign Purge 100 Health serverfarm submodeDfp Script task Show module csm serverfarm 101 Nat client serverfarm submodeNat client client-pool-name static Nat server source-macno nat server Nat server serverfarm submodeSource-mac 102 103 Predictor serverfarm submode 104 105 106 Probe serverfarm submode Retcode-mapretcodemapname no retcode-map Retcode-map serverfarm submodeMap retcode Script task Show module csm serverfarm Show module csm This example shows how to display static dataReal static NAT submode Static Related Commands arp Mode rp onlyShow module csm arp Show module csm slot arp Show module csm capp udp details Show module csm cappSyntax Description 110 111 112 Show module csm connsState Explanation Synsrv Related Commands module csmReqwait 113 Show module csm dfp WeightsAgent Manager 115 Show module csm ft Mode rp onlyShow module csm slot ft detail 116 Url Show module csm mapHeader Name Related Commands map cookie This example shows how to display return code mapsMap header map url module csm 118 Show module csm slot memory vserver vserver-name detail Show module csm memoryParse-length virtual server submode 119 Show module csm natpool Ip slb mode rp onlyShow module csm slot natpool name pool-name detail Natpool module CSM submode Show module csm slot owner name owner-name detail Show module csm ownerOwner virtual server submode 121 Show module csm policy Slb mode rp onlyShow module csm slot policy name policy-name 122 123 Show module csm probe 124 Probe serverfarm submode Show module csm slot probe script name probe-name detail Show module csm probe scriptProbe serverfarm submode script probe submode 125 Show module csm slot pvlan Show module csm pvlan126 Cat6k-2#show module csm 4 pvlan Show module csm slot real sfarm sfarm-name detail Show module csm realSfarm This example shows Cisco IOS SLB real server data 128 Field Description Show module csm slot real retcode sfarm sfarm-name detail Show module csm real retcode129 Cat6k-2#show module csm 5 real retcode Show module csm slot script name fullfileURL code Show module csm scriptCode 130 Show module csm script task This example shows how to display a running scriptShow module csm slot script task index script-index detail Index Show module csm serverfarm For ip slb mode rp onlyShow module csm slot serverfarm name serverfarm-name detail 132 Redirect Bind id Field133 Cat6k-2#show mod csm 5 serverfarm detail Drop Show module csm staticNat Virtual 135 Show module csm static serverPass-through 136 Real static NAT submode static Show module csm stats This example shows how to display SLB statisticsShow module csm slot stats Statistics counters are 32-bit 138 3describes the fields in the display Show module csm status This example shows how to display CSM statusShow module csm slot status 139 Show module csm slot sticky groups client ipaddress Show module csm stickyGroups 140 141 4describes the fields in the displaySticky Sticky virtual server submode Show module csm slot tech-script Show module csm tech-script142 Cat6k-2#show module csm 4 tech-script 143 Show module csm tech-support Cat6k-2#show module csm 4 tech-support processor 144 145 Show module csm variable Variable commandShow module csm slot variable name name detail 146 Cat6k-2#show module csm 5 variable detail Csm slot variable detail command147 Client Show module csm vlanServer Vlan-id 149 Related Commands vlan virtual server submode This example shows how to display the CSM virtual servers Redirect for ip slb mode rp onlyShow module csm vserver redirect Show module csm slot vserver redirect 151 Related Commands xml-config This example shows how to display the CSM XML statisticsShow module csm xml stats Show module csm xml stats Snmp enable traps slb ft no snmp enable traps slb ft Snmp enable traps slb ftActive after detecting a failure in its fault tolerant peer This example shows how to enable fault tolerant traps Nat client serverfarm submode StaticShow module csm static 154 Real static NAT submode SLB static NAT configuration submodeShow module csm static Static 156 Sticky 157 Cat6k-2config-module-csm#sticky 5 header headername timeoutRouterconfig-module-csm#variable Notimeoutipstickyentries No cookie offset Cookie offset sticky submodeOffset offset Length length Cookie secondary sticky submode This example shows how to specify a secondary sticky entryCookie secondary name no cookie secondary Name Specifies a cookie name Header offset value length value Header sticky submodeOffset value Length value 161 Static sticky submode 162 Vserver Server as host route Advertise virtual server submodeRedirect-vserver 163 164 Ip access-list standardClient virtual server submode Cat6k-2config-slb-vserver#description Backup Server Farm Related Commands vserverDescription virtual server submode 165 166 This example shows how to set a domain nameDomain virtual server submode 167 This example shows how to specify an idle timer durationIdle virtual server submode 168 Inservice virtual server submodeVirtual server is not in service No owner maxconns Owner virtual server submodeMaxconns Advertise virtual server submode Parse-length virtual server submode Default is SLB virtual server configuration submodeParse-length bytes No parse-length Bytes Number of bytes the range is from 1 to Default pending timeout is 30 seconds Pending timeout no pendingPending virtual server submode 171 Persistent rebalance virtual server submode This example shows how to enable the Http 1.1 persistencePersistent rebalance No persistent rebalance 172 Sticky Replicate csrp virtual server submodeConnection 173 174 Reverse-sticky virtual server submodeReverse-sticky group-id No reverse-sticky Threshold outservice realvalue inservice realvalue options BackupServerfarm command Serverfarm virtual server submode 176 CommandServerfarm policy submode Slb-policypolicy-name priority priorityvalue Slb-policy virtual server submodeNo slb-policy policy-name 177 Ssl-sticky offset X length Y No ssl-sticky Ssl-sticky virtual server submodeOffset Length Status-tracking vservername Status-tracking virtual server submodeVservername Identifies the dependent virtual server 179 180 Sticky virtual server submode 181 For connection couplingReverse-sticky virtual server submode Default No default unidirectionalRelated Commands show module csm vserver redirect Unidirectional virtual server submode 183 Url-hash virtual server submodePredictor serverfarm submode 184 Virtual virtual server submode 185 186 No vlan Vlan virtual server submodeShow module csm vlan Vlan virtual server submode 187 Vlan vlan-numberclient server No vlan VlanClient server 188 Alias ip-address netmask No alias ip-address netmask Alias Vlan submodeVlan Netmask 190 Related Commands show module csm vlan vlan XML submode 191 Ip address Vlan submode SLB Vlan configuration submodeDescription Vlan submode Gateway ip-addressno gateway ip-address Gateway Vlan submodeShow module csm vlan Vlan virtual server submode 192 No ip address Ip address Vlan submodeAlt 193 Gateway Route Vlan submodeGw-ip-address 194 Xml-config no xml-config Xml-configClient-group XML submode Credentials XML submode Vlan XML submode Client-group XML submode Xml-configClient-group 1-99name 196 Credentials XML submode Credentials user-name passwordNo credentials user-name Client-group XML submode Defaults Command Modes Inservice XML submodeThis example shows how to enable XML Xml-config Port port-number Port XML submodeNo port Port-number Sets the CSM port Vlan id no vlan Vlan XML submodeVlan name All VLANs are accepted Commands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy vlan Ssl-proxy service Service name Clear ssl-proxy conn service nameSsl-proxy connection command without options Clear ssl-proxy conn Clear ssl-proxy session Clear ssl-proxy session service name Clear ssl-proxy stats Terminal Crypto ca export pemDes 3des Importing CA certificate Usage-keys Crypto ca import pemExportable Crypto ca export pem Pkcs12filename Crypto ca export pkcs12Tftp Page Crypto ca import pkcs12 Crypto This example shows how to import a PKCS12 file using SCPFilename TP2? /users/admin-1/pkcs12/TP2.p12 Optional Specifies that the key can be exported Crypto key export rsa pemKeylabel Name of the key Key nametest-keys UsageGeneral Purpose Key Instead of one general-purpose key pair Crypto key import rsa pemNull-Imports from the null file system System-Imports from the system file system Examples Debug ssl-proxy This example shows how to turn on FDU debugging This example shows how to turn on App debuggingThis example shows how to turn on IPC debugging This example shows how to turn on PKI debugging This example shows how to turn off TCP debugging This example shows how to turn on TCP debuggingSsl-proxy#debug ssl-proxy tcp Ssl-proxy#no debug ssl-proxy tcp Configuration mode Do commandCommand EXEC-level command to be executed Ssl-proxy#show ssl-proxy admin-info Show ssl-proxy admin-infoShow ssl-proxy admin-info Show ssl-proxy buffers This command has no default settingsShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffers Service name Show ssl-proxy certificate-history service nameOptionally for a specific proxy service Show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31 Ssl-proxy# show ssl-proxy certificate-history Related Commands ssl-proxy service Show ssl-proxy conn Show ssl-proxy conn service name4tuple Remote Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Show ssl-proxy crash-info brief details Show ssl-proxy crash-infoBrief Limited to processor registers Ssl-proxy#show ssl-proxy crash-info brief Stack top Printing 1024 bytes from stack top Show ssl-proxy mac address Show ssl-proxy mac addressModule with SSL Ssl-proxy#show ssl-proxy mac address Show ssl-proxy natpool name Show ssl-proxy natpoolName Optional NAT pool name Ssl-proxy#show ssl-proxy natpool NP1 Show ssl-proxy policy http-header ssl tcp url-rewrite name Show ssl-proxy policyHttp-header Url-rewrite MSS Show ssl-proxy service name Show ssl-proxy serviceName Optional Service name Ssl-proxy#show ssl-proxy service Proxy status No Client VLAN, No Server Vlan Ssl-proxy# Stats Show ssl-proxy statsShow ssl-proxy stats type Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage Counters This example shows how to display the PKI statistics Ssl-proxy# show ssl-prox stats fdu This example shows how to display the FDU statistics Show ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Ssl-proxy#show ssl-proxy version Show ssl-proxy versionShow ssl-proxy version Show ssl-proxy vlan vlan-iddebug Show ssl-proxy vlanDebug Optional Displays debug information Ssl-proxy#show ssl-proxy vlan This command has no default settings Exec modeShow ssl-proxy vts Defaults Command Modes Command History Examples Snmp-server enable This example shows how to start a cryptographic self-test Seconds Global configurationSsl-proxy crypto selftest Time-interval Ssl-proxy mac address mac-addr Related Commands show ssl-proxy mac addressSsl-proxy mac address Ssl-proxy natpool This example shows how to define a pool of IP addressesRelated Commands show ssl-proxy natpool Ssl-proxy pki Related Commands show ssl-proxy stats This example shows how to specify the cache sizeThis example shows how to enable PKI event-history Http-header-policy-name Http header policy name Ssl-proxy policy http-headerSsl-proxy policy http-header http-header-policy-name Custom custom-string Ssl-proxy policy ssl Timeout session timeout absoluteSsl-proxy policy ssl ssl-policy-name Ssl-policy-name SSL policy name Default cipher close-protocol RSAWITHRC4128SHA all No close-protocol enableNo session-cache enable Timeout handshake timeout This example shows how to disable session-cache This example shows how to enable session-cacheSsl-proxy config# ssl-proxy policy ssl sslpl1 Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHA This example shows how to print out a help Timeout reassembly is 60 seconds Defaults are as followsSsl-proxy policy tcp Ssl-proxy policy tcp tcp-policy-name No timeout reassembly time No timeout syn timeout-in-secondsNo buffer-share rx buffer-limit-in-bytes No buffer-share tx buffer-limit-in-bytes Related Commands show ssl-proxy policy Ssl-proxy policy url-rewrite url-rewrite-policy-name Ssl-proxy policy url-rewrite Ssl-proxyconfig-url-rewrite-policy# Ssl-proxy config# ssl-proxy policy url-rewrite test1 Ssl-proxy pool ca This command has no arguments or keywordsSsl-proxy pool ca-pool-name Ca-pool-name Certificate authority pool name Ssl-proxy service ssl-proxy-nameclient Ssl-proxy serviceSsl-proxy service client command Protocol protocol port portno subcommand Default certificate inservice nat server Authenticate verify all signature-onlyInservice Certificate rsa general-purpose trustpoint Ssl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Declares a proxy client as administratively up Ssl-proxy service clientExits from proxy-client configuration submode Applies a URL rewrite policy to the proxy server Sslv2 keyword enables SSL versionSsl-proxy config# ssl-proxy service S7 client Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxy config# no ssl-proxy ssl ratelimit Ssl-proxy config# ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxyy ssl ratelimit Ssl-proxy vlan AdminSsl-proxy vlan vlan Gateway prefix drop forward1 Standby delay minimum reload Standby authenticationStandby ip Standby mac-address Ssl-proxyconfig-vlan#ipaddr 10.1.0.20 Ssl-proxyconfig-vlan#ipaddr 208.59.100.18Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gateway Related Commands show ssl-proxy vlan Group-number is String is cisco Standby authentication Min-delay is 1 second Reload-delay is 5 seconds Standby delay minimum reload Ssl-proxyconfig-vlan#standby delay minimum 30 reload Show standby delay Proxy-VLAN configuration submode Hsrp is disabled by defaultStandby ip Secondary Used by the hot standby group is learned using Hsrp Standby group-numbermac-addressmac-address Standby mac-addressNo standby group-numbermac-address Mac-address MAC address Show standby Ssl-proxyconfig-vlan#standby 1 mac-addressThat is used in the end nodes Standby mac-refresh seconds no standby mac-refresh Standby mac-refresh Standby name Hsrp is disabledStandby name group-name No standby name group-name Group-name Specifies the name of the standby group Minimum delay DelayReload delay Sync delay Leaves any synchronization delay if it was configured Operation returns to the default behaviorSsl-proxyconfig-vlan#standby preempt delay minimum Clients Standby priority This example shows how to change the router priorityStandby group-numberpriority priority No standby group-numberpriority priority Standby track Disable EnableTimers Standby redirects Show standby redirect Related Commands show standbySsl-proxyconfig-vlan#standby redirects timers 90 Msec Standby timers Interface ethernet Standby track Command commands and take action when the object changesDecrement priority Back up Router B Configuration Router a ConfigurationRelated Commands standby preempt Standby priority Scope interface Standby use-biaStandby use-bia scope interface No standby use-bia OL-7029-01 Acronym Expansion CCA CbacCDP CEF Dsap DramDscp Dspu Icmp ICDIDB IDP Mdix MD5Mdss MFD OSM OSIOspf PAE ROM RmonRommon RPC SVC STPSVI TACACS+ WRR Weighted round-robinXNS Xerox Network System OL-7029-01 Http Capp UDPCapp IN-1 IN-2 NATXML IN-3 FTP See FTPGslb IN-4 IN-5 Secondary interface IN-6 ConfigurationPool addresses IN-7 Gslb Http IN-8 Real server Backup Enabling IN-9 Smtp IN-10 TCPURL IN-11 IN-12 Credentials Enabling Port Statistics display Vlan

Cisco Systems OL-7029-01 manual 115

Models: OL-7029-01

2-115