Cisco Systems OL-7029-01 manual

Chapter 3 Commands Specific to the Content Switching Module with SSL

crypto ca export pkcs12

Writing TP1.p12 Writing pkcs12 file to scp://admin-1@10.1.1.1/TP1.p12

Password:

CRYPTO_PKI:Exported PKCS12 file successfully. ssl-proxy(config)#

Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

	OL-7029-01	3-13

Page 235

Image 235

Contents

Text Part Number OL-7029-01 Corporate HeadquartersPage Iii N T E N T S Hw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Vii Show module csm static server Viii Vlan virtual server submode Ssl-proxy policy url-rewrite Acronyms A-1 Organization AudienceChapter Title Description Boldface ConventionsConvention Description Boldface font Obtaining Documentation Related DocumentationXiii Xiv Documentation FeedbackCisco Product Security Overview Cisco Ordering tool Cisco Marketplace An emergency, you can also reach Psirt by telephone 877 408 Obtaining Technical Assistance Xvi Submitting a Service Request Xvii Obtaining Additional Publications and Information Xviii Command Task Using Content Switching Module Commands # prompt is displayed Command Modes Zero or more characters Submodes When you are in a submode, the prompt changes toRegular Expressions Expression Meaning Newline Ascii Alert AsciiBackspace Ascii Form-feed Ascii Content Switching Module with SSL Commands Release Modification Defaults Command Modes Command HistoryArp Vlan id Capp udp No capp udp Syntax Description DefaultsCommand Modes Command History Capp udp Related Commands port Capp UDP submode Encryption MD5 Related Commands capp udpOptions Capp UDP submode No options ipaddress Capp udp This example shows how to set the port for Capp connectionsPort Capp UDP submode Port portnum no port Secure No secure Secure Capp UDP submode Clear module csm Password No dfp password passwordDfp Related Commands show module csm dfp Dfp Agent DFP submodeManager DFP submode Show module csm dfp Agent DFP submode Syntax Description Defaults Command ModesManager DFP submode Manager port No manager Exit Exit No ft group Module CSM configuration submodeFt group Ft group group-id vlan vlan number Priority fault tolerant submode Failover fault tolerant submodeHeartbeat-time fault tolerant submode Preempt fault tolerant submode Ft group Failover fault tolerant submodeFailover failover-time No failover Show module csm ft Heartbeat-time fault tolerant submodeHeartbeat-time heartbeat-timeno heartbeat-time Ft group Related Commands ft group Preempt fault tolerant submodePreempt No preempt Value Priority fault tolerant submodePriority value alt value No priority Alt CSM Preempt fault tolerant submode Track fault tolerant submode Ip address Vlan submode priority fault tolerant submode Hw-module csm standby config-syncHw-module csm slot standby config-sync Syntax Description Defaults Command Modes Command History Keyword to select the route processor Cisco IOS SLB mode Ip slb modeIp slb mode csm rp no ip slb mode Csm On the Catalyst 6500 series switch Module csm Show ip slb mode Match protocol http cookie cookie map submode Map cookieCookie Cookie-map policy submode Cookie-value Match protocol http cookie cookie map submodeMap cookie Show module csm map Match protocol dns domain DNS map submode DNS domains can be configured to a mapThis example shows how to group DNS domains Map dns Name Names the DNS domain being mapped SLB DNS map configuration submodeThis example shows how to add domains to a DNS map Match protocol dns domain DNS map submode Insert protocol http header header map submode Map headerMap name header no map name Header-map policy submode Header-value value Insert protocol http header header map submodeHeader-map policy submode map header Show module csm map Must be matched SLB header map configuration submodeMatch protocol http header header map submode Header-value expression Map name retcode No map name Keyword to enter the return error code map submodeThis command has no default settings CSM module submode Map retcode Action log Map retcode SLB policy configuration submodeMatch protocol http retcode return code map submode Action count Match protocol http url URL map submode Map urlMap url-map-name url no map url-map-name Url-map-name Map url Show module csm map url-map policy submode SLB URL map configuration submodeUsage Guidelines Examples Related Commands Match protocol http url URL map submode Module csm slot-number No module csm slot-number Slot-number Slot number where the CSM residesIp slb mode Module csm Show module csm natpool Natpool module CSM submodeNetmask netmask Nat client serverfarm submode Variable module CSM submode Name Default Valid Values DescriptionVariable name value no variable name Advertiserhifreq AggregatebackupsfstatetovNoresetunidirectionalflows Switchoverrpaction Show module csm variable Contact-info owner submode Maxconns owner submode OwnerOwner name no owner Billing-info owner submode Contact-info owner submode Billing-info owner submodeBilling-infobilling-address-information No billing-info Contact-info string no contact-info Contact-info owner submodeString Owner’s information Accept further connections Maxconns owner submodeMaxconns number no maxconns Number Number of maximum connections to the owner object Show module csm owner All policies should be configured with a server farmPolicy Policy policy-name no policy policy-name Policy Show module csm owner Ip access-list standardClient-group policy submode No client-group Map cookie Cookie-map policy submodeCookie-mapcookie-map-name No cookie-map Map header Specified in the map header commandHeader-map policy submode Header-map name No header-map Natpool module CSM submode Nat client policy submodeNo nat client Static Serverfarm policy submode Serverfarm virtual server submode Policy Dscp-value Range is from 0 to Default is that the CSM does not store Dscp valuesSet ip dscp policy submode Set ip dscp dscp-valueno set ip dscp Show module csm owner Show module csm sticky Sticky This example shows how to configure a sticky groupSticky-group policy submode Sticky-group group-id No sticky-group Map url Default is no URL mapUrl-map policy submode Url-mapurl-map-name no url-map Probe Show module csm probe Probe Probe Address probe submodeNo address ip-address Routed Credentials probe submode Credentials username passwordSLB Http probe configuration submode This command is for Http probes Description line No description Description serverfarm submodeLine Description text Expect status probe submode Enter the no expect status 34 99 command Related Commands probe Failed failed-interval no failed Default value for the failed interval is 300 secondsThis command is used for all probe types Failed probe submode Probe Show module csm probe Header probe submodeHeader field-name field-value No header field-name Interval seconds no interval Interval probe submode Name probe submode SLB DNS probe configuration submodeName domain-name no name Open probe submode Open open-timeout no openDefault value for the open timeout is 10 seconds SLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Port-number Sets the port number Default value for the port number isPort probe submode Port port-number no port Receive probe submode Receive receive-timeout no receiveDefault value for a receive timeout is 10 seconds This command is available for all probe types except TCP This command is available for all probe types Recover probe submodeRecover recovervalue no recover Default value is Url path Request probe submodeMethod get Method head Retries probe submode Default value for retries isRetries retry-count no retries Failed probe submode Script probe submodeScript scriptname Scriptname Specifies a probe script Real ip-address port local No real ip-address port Default is no port translation for the real serverSLB serverfarm configuration submode Real Cat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Failaction serverfarm submode Backup real real server submodeBackup real ip name name port no backup real Name name Tag Health probe real server submodeHealth probe probe-nametag string No health probe Real Show module csm real Inservice real server submodeInservice standby No inservice Standby Command History Release Modification Minconns real server submode Maxconns real server submodeMaxconns max-conns no maxconns Real server falls below Minconns Maxconns real server submode real Show module csm real Default value is the set minumum number of connectionsMinconns real server submode Minconns min-consno minconns Redirect-vserver name no redirect-vserver Redirect-vserver real server submodeTraffic is not redirected to the server Predictor serverfarm submode Weight real server submodeWeight weighting-value no weight Weighting value default is Redirect-vserver This example shows how to name the virtual serverRedirect-vserver name no redirect-vserver name Advertise virtual server submode Advertise redirect virtual server submodeAdvertise active no advertise Active Optional Specifies that the IP address is disallowed SLB redirect virtual server configuration submodeClient redirect virtual server submode Exclude Redirect-vserver real server submode Idle redirect virtual server submodeIdle duration No idle Inservice No inservice Inservice redirect virtual server submodeRedirect-vserver Show module csm vserver redirect Replicate csrp No replicate csrp Replicate csrp redirect virtual server submodeVserver Ftp Ssl redirect virtual server submodeNo ssl Https Show module csm vserver redirect Virtual redirect virtual server submodeNo virtual vipaddress Redirect-vserver real server submode Show module csm sticky Vlan redirect virtual server submodeSticky Sticky-group policy submode 302 Webhost backup redirect virtual server submodeWebhost backup backup-string301 No webhost backup 301 Webhost relocation redirect virtual server submode Reverse-sticky group-idno reverse-sticky Reverse-stickySticky Sticky-group policy submode No script file Script file Related Commands show module csm script Show module csm script Script task100 Script name Serverfarm serverfarm-name No serverfarm serverfarm-name Serverfarm Dfp SLB serverfarm configuration submodeBindid serverfarm submode Bindid bind-idno bindid This example shows how to add a description CSM release This command was introducedCat6k-2config-slb-sfarm#description Backup Server Farm Purge Backup real real server submodeFailaction serverfarm submode Failaction purge reassign No failaction purge reassign Dfp Script task Show module csm serverfarm Health serverfarm submode100 Nat client client-pool-name static Nat client serverfarm submode101 102 Nat server serverfarm submodeNat server source-macno nat server Source-mac 103 Predictor serverfarm submode 104 105 106 Probe serverfarm submode Script task Show module csm serverfarm Retcode-map serverfarm submodeRetcode-mapretcodemapname no retcode-map Map retcode Static This example shows how to display static dataShow module csm Real static NAT submode Show module csm slot arp Mode rp onlyRelated Commands arp Show module csm arp 110 Show module csm cappShow module csm capp udp details Syntax Description 111 State Explanation Show module csm conns112 113 Related Commands module csmSynsrv Reqwait Manager WeightsShow module csm dfp Agent 115 116 Mode rp onlyShow module csm ft Show module csm slot ft detail Name Show module csm mapUrl Header 118 This example shows how to display return code mapsRelated Commands map cookie Map header map url module csm 119 Show module csm memoryShow module csm slot memory vserver vserver-name detail Parse-length virtual server submode Natpool module CSM submode Ip slb mode rp onlyShow module csm natpool Show module csm slot natpool name pool-name detail 121 Show module csm ownerShow module csm slot owner name owner-name detail Owner virtual server submode 122 Slb mode rp onlyShow module csm policy Show module csm slot policy name policy-name 123 Show module csm probe 124 Probe serverfarm submode 125 Show module csm probe scriptShow module csm slot probe script name probe-name detail Probe serverfarm submode script probe submode Cat6k-2#show module csm 4 pvlan Show module csm pvlanShow module csm slot pvlan 126 This example shows Cisco IOS SLB real server data Show module csm realShow module csm slot real sfarm sfarm-name detail Sfarm 128 Field Description Cat6k-2#show module csm 5 real retcode Show module csm real retcodeShow module csm slot real retcode sfarm sfarm-name detail 129 130 Show module csm scriptShow module csm slot script name fullfileURL code Code Index This example shows how to display a running scriptShow module csm script task Show module csm slot script task index script-index detail 132 For ip slb mode rp onlyShow module csm serverfarm Show module csm slot serverfarm name serverfarm-name detail Cat6k-2#show mod csm 5 serverfarm detail FieldRedirect Bind id 133 Virtual Show module csm staticDrop Nat Pass-through Show module csm static server135 136 Real static NAT submode static Statistics counters are 32-bit This example shows how to display SLB statisticsShow module csm stats Show module csm slot stats 138 3describes the fields in the display 139 This example shows how to display CSM statusShow module csm status Show module csm slot status 140 Show module csm stickyShow module csm slot sticky groups client ipaddress Groups Sticky Sticky virtual server submode 4describes the fields in the display141 Cat6k-2#show module csm 4 tech-script Show module csm tech-scriptShow module csm slot tech-script 142 143 Show module csm tech-support Cat6k-2#show module csm 4 tech-support processor 144 145 146 Variable commandShow module csm variable Show module csm slot variable name name detail 147 Csm slot variable detail commandCat6k-2#show module csm 5 variable detail Vlan-id Show module csm vlanClient Server 149 Related Commands vlan virtual server submode Show module csm slot vserver redirect Redirect for ip slb mode rp onlyThis example shows how to display the CSM virtual servers Show module csm vserver redirect 151 Show module csm xml stats This example shows how to display the CSM XML statisticsRelated Commands xml-config Show module csm xml stats This example shows how to enable fault tolerant traps Snmp enable traps slb ftSnmp enable traps slb ft no snmp enable traps slb ft Active after detecting a failure in its fault tolerant peer 154 StaticNat client serverfarm submode Show module csm static Static SLB static NAT configuration submodeReal static NAT submode Show module csm static 156 Sticky Routerconfig-module-csm#variable Notimeoutipstickyentries Cat6k-2config-module-csm#sticky 5 header headername timeout157 Length length Cookie offset sticky submodeNo cookie offset Offset offset Name Specifies a cookie name This example shows how to specify a secondary sticky entryCookie secondary sticky submode Cookie secondary name no cookie secondary Length value Header sticky submodeHeader offset value length value Offset value 161 Static sticky submode 162 Vserver 163 Advertise virtual server submodeServer as host route Redirect-vserver Client virtual server submode Ip access-list standard164 165 Related Commands vserverCat6k-2config-slb-vserver#description Backup Server Farm Description virtual server submode Domain virtual server submode This example shows how to set a domain name166 Idle virtual server submode This example shows how to specify an idle timer duration167 Virtual server is not in service Inservice virtual server submode168 Advertise virtual server submode Owner virtual server submodeNo owner maxconns Maxconns Bytes Number of bytes the range is from 1 to Default is SLB virtual server configuration submodeParse-length virtual server submode Parse-length bytes No parse-length 171 Pending timeout no pendingDefault pending timeout is 30 seconds Pending virtual server submode 172 This example shows how to enable the Http 1.1 persistencePersistent rebalance virtual server submode Persistent rebalance No persistent rebalance 173 Replicate csrp virtual server submodeSticky Connection Reverse-sticky group-id No reverse-sticky Reverse-sticky virtual server submode174 Serverfarm virtual server submode BackupThreshold outservice realvalue inservice realvalue options Serverfarm command Serverfarm policy submode Command176 177 Slb-policy virtual server submodeSlb-policypolicy-name priority priorityvalue No slb-policy policy-name Length Ssl-sticky virtual server submodeSsl-sticky offset X length Y No ssl-sticky Offset 179 Status-tracking virtual server submodeStatus-tracking vservername Vservername Identifies the dependent virtual server 180 Sticky virtual server submode Reverse-sticky virtual server submode For connection coupling181 Unidirectional virtual server submode No default unidirectionalDefault Related Commands show module csm vserver redirect Predictor serverfarm submode Url-hash virtual server submode183 184 Virtual virtual server submode 185 186 187 Vlan virtual server submodeNo vlan Show module csm vlan Vlan virtual server submode 188 VlanVlan vlan-numberclient server No vlan Client server Netmask Alias Vlan submodeAlias ip-address netmask No alias ip-address netmask Vlan 190 Related Commands show module csm vlan vlan XML submode Description Vlan submode Ip address Vlan submode SLB Vlan configuration submode191 192 Gateway Vlan submodeGateway ip-addressno gateway ip-address Show module csm vlan Vlan virtual server submode 193 Ip address Vlan submodeNo ip address Alt 194 Route Vlan submodeGateway Gw-ip-address Credentials XML submode Vlan XML submode Xml-configXml-config no xml-config Client-group XML submode 196 Xml-configClient-group XML submode Client-group 1-99name Client-group XML submode Credentials user-name passwordCredentials XML submode No credentials user-name Xml-config Inservice XML submodeDefaults Command Modes This example shows how to enable XML Port-number Sets the CSM port Port XML submodePort port-number No port All VLANs are accepted Vlan XML submodeVlan id no vlan Vlan name Commands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy vlan Ssl-proxy service Clear ssl-proxy conn Clear ssl-proxy conn service nameService name Ssl-proxy connection command without options Clear ssl-proxy session Clear ssl-proxy session service name Clear ssl-proxy stats 3des Crypto ca export pemTerminal Des Importing CA certificate Exportable Crypto ca import pemUsage-keys Crypto ca export pem Tftp Crypto ca export pkcs12Pkcs12filename Page Crypto ca import pkcs12 Filename TP2? /users/admin-1/pkcs12/TP2.p12 This example shows how to import a PKCS12 file using SCPCrypto Keylabel Name of the key Crypto key export rsa pemOptional Specifies that the key can be exported Key nametest-keys UsageGeneral Purpose Key System-Imports from the system file system Crypto key import rsa pemInstead of one general-purpose key pair Null-Imports from the null file system Examples Debug ssl-proxy This example shows how to turn on PKI debugging This example shows how to turn on App debuggingThis example shows how to turn on FDU debugging This example shows how to turn on IPC debugging Ssl-proxy#no debug ssl-proxy tcp This example shows how to turn on TCP debuggingThis example shows how to turn off TCP debugging Ssl-proxy#debug ssl-proxy tcp Command EXEC-level command to be executed Do commandConfiguration mode Show ssl-proxy admin-info Show ssl-proxy admin-infoSsl-proxy#show ssl-proxy admin-info Ssl-proxy#show ssl-proxy buffers This command has no default settingsShow ssl-proxy buffers Show ssl-proxy buffers Show ssl-proxy certificate-history Show ssl-proxy certificate-history service nameService name Optionally for a specific proxy service Record 1, Timestamp000051, 163634 UTC Oct 31 Ssl-proxy# show ssl-proxy certificate-history Related Commands ssl-proxy service Remote Show ssl-proxy conn service nameShow ssl-proxy conn 4tuple Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Limited to processor registers Show ssl-proxy crash-infoShow ssl-proxy crash-info brief details Brief Ssl-proxy#show ssl-proxy crash-info brief Stack top Printing 1024 bytes from stack top Ssl-proxy#show ssl-proxy mac address Show ssl-proxy mac addressShow ssl-proxy mac address Module with SSL Ssl-proxy#show ssl-proxy natpool NP1 Show ssl-proxy natpoolShow ssl-proxy natpool name Name Optional NAT pool name Url-rewrite Show ssl-proxy policyShow ssl-proxy policy http-header ssl tcp url-rewrite name Http-header MSS Ssl-proxy#show ssl-proxy service Show ssl-proxy serviceShow ssl-proxy service name Name Optional Service name Proxy status No Client VLAN, No Server Vlan Ssl-proxy# Show ssl-proxy stats type Show ssl-proxy statsStats Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage Counters This example shows how to display the PKI statistics Ssl-proxy# show ssl-prox stats fdu This example shows how to display the FDU statistics Show ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Show ssl-proxy version Show ssl-proxy versionSsl-proxy#show ssl-proxy version Optional Displays debug information Show ssl-proxy vlanShow ssl-proxy vlan vlan-iddebug Debug Show ssl-proxy vts This command has no default settings Exec modeSsl-proxy#show ssl-proxy vlan Defaults Command Modes Command History Examples Snmp-server enable Time-interval Seconds Global configurationThis example shows how to start a cryptographic self-test Ssl-proxy crypto selftest Ssl-proxy mac address Related Commands show ssl-proxy mac addressSsl-proxy mac address mac-addr Related Commands show ssl-proxy natpool This example shows how to define a pool of IP addressesSsl-proxy natpool Ssl-proxy pki This example shows how to enable PKI event-history This example shows how to specify the cache sizeRelated Commands show ssl-proxy stats Ssl-proxy policy http-header http-header-policy-name Ssl-proxy policy http-headerHttp-header-policy-name Http header policy name Custom custom-string Ssl-policy-name SSL policy name Timeout session timeout absoluteSsl-proxy policy ssl Ssl-proxy policy ssl ssl-policy-name Timeout handshake timeout RSAWITHRC4128SHA all No close-protocol enableDefault cipher close-protocol No session-cache enable Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHA This example shows how to enable session-cacheThis example shows how to disable session-cache Ssl-proxy config# ssl-proxy policy ssl sslpl1 This example shows how to print out a help Ssl-proxy policy tcp tcp-policy-name Defaults are as followsTimeout reassembly is 60 seconds Ssl-proxy policy tcp No buffer-share tx buffer-limit-in-bytes No timeout syn timeout-in-secondsNo timeout reassembly time No buffer-share rx buffer-limit-in-bytes Related Commands show ssl-proxy policy Ssl-proxy policy url-rewrite url-rewrite-policy-name Ssl-proxy policy url-rewrite Ssl-proxyconfig-url-rewrite-policy# Ssl-proxy config# ssl-proxy policy url-rewrite test1 Ca-pool-name Certificate authority pool name This command has no arguments or keywordsSsl-proxy pool ca Ssl-proxy pool ca-pool-name Protocol protocol port portno subcommand Ssl-proxy serviceSsl-proxy service ssl-proxy-nameclient Ssl-proxy service client command Certificate rsa general-purpose trustpoint Authenticate verify all signature-onlyDefault certificate inservice nat server Inservice Ssl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Exits from proxy-client configuration submode Ssl-proxy service clientDeclares a proxy client as administratively up Ssl-proxy config# ssl-proxy service S7 client Sslv2 keyword enables SSL versionApplies a URL rewrite policy to the proxy server Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxyy ssl ratelimit Ssl-proxy config# ssl-proxy ssl ratelimitSsl-proxy config# no ssl-proxy ssl ratelimit Ssl-proxy ssl ratelimit Gateway prefix drop forward1 AdminSsl-proxy vlan Ssl-proxy vlan vlan Standby mac-address Standby authenticationStandby delay minimum reload Standby ip Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gateway Ssl-proxyconfig-vlan#ipaddr 208.59.100.18Ssl-proxyconfig-vlan#ipaddr 10.1.0.20 Related Commands show ssl-proxy vlan Group-number is String is cisco Standby authentication Min-delay is 1 second Reload-delay is 5 seconds Standby delay minimum reload Ssl-proxyconfig-vlan#standby delay minimum 30 reload Show standby delay Secondary Hsrp is disabled by defaultProxy-VLAN configuration submode Standby ip Used by the hot standby group is learned using Hsrp Mac-address MAC address Standby mac-addressStandby group-numbermac-addressmac-address No standby group-numbermac-address That is used in the end nodes Ssl-proxyconfig-vlan#standby 1 mac-addressShow standby Standby mac-refresh seconds no standby mac-refresh Standby mac-refresh Group-name Specifies the name of the standby group Hsrp is disabledStandby name Standby name group-name No standby name group-name Sync delay DelayMinimum delay Reload delay Clients Operation returns to the default behaviorLeaves any synchronization delay if it was configured Ssl-proxyconfig-vlan#standby preempt delay minimum No standby group-numberpriority priority This example shows how to change the router priorityStandby priority Standby group-numberpriority priority Standby track Standby redirects EnableDisable Timers Ssl-proxyconfig-vlan#standby redirects timers 90 Related Commands show standbyShow standby redirect Msec Standby timers Interface ethernet Back up Command commands and take action when the object changesStandby track Decrement priority Standby priority Router a ConfigurationRouter B Configuration Related Commands standby preempt Standby use-bia scope interface No standby use-bia Standby use-biaScope interface OL-7029-01 Acronym Expansion CEF CbacCCA CDP Dspu DramDsap Dscp IDP ICDIcmp IDB MFD MD5Mdix Mdss PAE OSIOSM Ospf RPC RmonROM Rommon TACACS+ STPSVC SVI Xerox Network System Weighted round-robinWRR XNS OL-7029-01 IN-1 Capp UDPHttp Capp XML NATIN-2 IN-3 IN-4 See FTPFTP Gslb IN-5 Secondary interface Pool addresses ConfigurationIN-6 IN-7 Gslb Http IN-8 Real server Backup Enabling IN-9 Smtp URL TCPIN-10 IN-11 IN-12 Credentials Enabling Port Statistics display Vlan