Ssl-proxy#debug ssl-proxy tcp | Cisco Systems OL-7029-01 guide

Chapter 3 Commands Specific to the Content Switching Module with SSL

debug ssl-proxy

This example shows how to turn on TCP debugging:

ssl-proxy#debug ssl-proxy tcp

ssl-proxy#

This example shows how to turn off TCP debugging:

ssl-proxy#no debug ssl-proxy tcp

ssl-proxy#

Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

3-22	OL-7029-01

Image 244

Cisco Systems OL-7029-01 This example shows how to turn on TCP debugging, This example shows how to turn off TCP debugging

Contents

Corporate Headquarters Text Part Number OL-7029-01Page N T E N T S Iii Hw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Show module csm static server Vii Vlan virtual server submode Viii Ssl-proxy policy url-rewrite Acronyms A-1 Organization AudienceChapter Title Description Conventions Convention DescriptionBoldface font Boldface Obtaining Documentation Related DocumentationXiii Documentation Feedback Cisco Product Security OverviewCisco Ordering tool Cisco Marketplace Xiv Obtaining Technical Assistance An emergency, you can also reach Psirt by telephone 877 408 Submitting a Service Request Xvi Obtaining Additional Publications and Information Xvii Xviii Using Content Switching Module Commands Command Task Command Modes # prompt is displayed Submodes When you are in a submode, the prompt changes to Regular ExpressionsExpression Meaning Zero or more characters Alert Ascii Backspace AsciiForm-feed Ascii Newline Ascii Content Switching Module with SSL Commands Defaults Command Modes Command History ArpVlan id Release Modification Syntax Description Defaults Command Modes Command HistoryCapp udp Capp udp No capp udp Related Commands port Capp UDP submode Related Commands capp udp Options Capp UDP submodeNo options ipaddress Encryption MD5 This example shows how to set the port for Capp connections Port Capp UDP submodePort portnum no port Capp udp Secure Capp UDP submode Secure No secure Clear module csm Password No dfp password passwordDfp Related Commands show module csm dfp Dfp Agent DFP submodeManager DFP submode Show module csm dfp Syntax Description Defaults Command Modes Manager DFP submodeManager port No manager Agent DFP submode Exit Exit Module CSM configuration submode Ft groupFt group group-id vlan vlan number No ft group Failover fault tolerant submode Heartbeat-time fault tolerant submodePreempt fault tolerant submode Priority fault tolerant submode Failover fault tolerant submode Failover failover-timeNo failover Ft group Heartbeat-time fault tolerant submode Heartbeat-time heartbeat-timeno heartbeat-timeFt group Show module csm ft Related Commands ft group Preempt fault tolerant submodePreempt No preempt Priority fault tolerant submode Priority value alt value No priority AltCSM Value Track fault tolerant submode Preempt fault tolerant submode Hw-module csm standby config-sync Hw-module csm slot standby config-syncSyntax Description Defaults Command Modes Command History Ip address Vlan submode priority fault tolerant submode Ip slb mode Ip slb mode csm rp no ip slb mode CsmOn the Catalyst 6500 series switch Keyword to select the route processor Cisco IOS SLB mode Show ip slb mode Module csm Map cookie CookieCookie-map policy submode Match protocol http cookie cookie map submode Cookie-value Match protocol http cookie cookie map submodeMap cookie Show module csm map DNS domains can be configured to a map This example shows how to group DNS domainsMap dns Match protocol dns domain DNS map submode SLB DNS map configuration submode This example shows how to add domains to a DNS mapMatch protocol dns domain DNS map submode Name Names the DNS domain being mapped Map header Map name header no map nameHeader-map policy submode Insert protocol http header header map submode Header-value value Insert protocol http header header map submodeHeader-map policy submode map header Show module csm map SLB header map configuration submode Match protocol http header header map submodeHeader-value expression Must be matched Keyword to enter the return error code map submode This command has no default settings CSM module submodeMap retcode Map name retcode No map name Map retcode SLB policy configuration submode Match protocol http retcode return code map submodeAction count Action log Map url Map url-map-name url no map url-map-nameUrl-map-name Match protocol http url URL map submode SLB URL map configuration submode Usage Guidelines Examples Related CommandsMatch protocol http url URL map submode Map url Show module csm map url-map policy submode Slot-number Slot number where the CSM resides Ip slb modeModule csm Module csm slot-number No module csm slot-number Natpool module CSM submode Netmask netmaskNat client serverfarm submode Show module csm natpool Variable module CSM submode Name Default Valid Values DescriptionVariable name value no variable name Aggregatebackupsfstatetov NoresetunidirectionalflowsSwitchoverrpaction Advertiserhifreq Show module csm variable Owner Owner name no ownerBilling-info owner submode Contact-info owner submode Maxconns owner submode Billing-info owner submode Billing-infobilling-address-informationNo billing-info Contact-info owner submode Contact-info string no contact-info Contact-info owner submodeString Owner’s information Maxconns owner submode Maxconns number no maxconnsNumber Number of maximum connections to the owner object Accept further connections All policies should be configured with a server farm PolicyPolicy policy-name no policy policy-name Show module csm owner Ip access-list standard Client-group policy submodeNo client-group Policy Show module csm owner Cookie-map policy submode Cookie-mapcookie-map-nameNo cookie-map Map cookie Specified in the map header command Header-map policy submodeHeader-map name No header-map Map header Nat client policy submode No nat clientStatic Natpool module CSM submode Serverfarm policy submode Policy Serverfarm virtual server submode Default is that the CSM does not store Dscp values Set ip dscp policy submodeSet ip dscp dscp-valueno set ip dscp Dscp-value Range is from 0 to This example shows how to configure a sticky group Sticky-group policy submodeSticky-group group-id No sticky-group Show module csm owner Show module csm sticky Sticky Default is no URL map Url-map policy submodeUrl-mapurl-map-name no url-map Map url Probe Probe Show module csm probe Address probe submode No address ip-addressRouted Probe Credentials username password SLB Http probe configuration submodeThis command is for Http probes Credentials probe submode Description line No description Description serverfarm submodeLine Description text Enter the no expect status 34 99 command Expect status probe submode Related Commands probe Default value for the failed interval is 300 seconds This command is used for all probe typesFailed probe submode Failed failed-interval no failed Header probe submode Header field-name field-valueNo header field-name Probe Show module csm probe Interval probe submode Interval seconds no interval Name probe submode SLB DNS probe configuration submodeName domain-name no name Open open-timeout no open Default value for the open timeout is 10 secondsSLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Open probe submode Default value for the port number is Port probe submodePort port-number no port Port-number Sets the port number Receive receive-timeout no receive Default value for a receive timeout is 10 secondsThis command is available for all probe types except TCP Receive probe submode Recover probe submode Recover recovervalue no recoverDefault value is This command is available for all probe types Request probe submode Method getMethod head Url path Retries probe submode Default value for retries isRetries retry-count no retries Script probe submode Script scriptnameScriptname Specifies a probe script Failed probe submode Default is no port translation for the real server SLB serverfarm configuration submodeReal Real ip-address port local No real ip-address port Cat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Backup real real server submode Backup real ip name name port no backup realName name Failaction serverfarm submode Health probe real server submode Health probe probe-nametag stringNo health probe Tag Inservice real server submode Inservice standby No inservice StandbyCommand History Release Modification Real Show module csm real Maxconns real server submode Maxconns max-conns no maxconnsReal server falls below Minconns Minconns real server submode Default value is the set minumum number of connections Minconns real server submodeMinconns min-consno minconns Maxconns real server submode real Show module csm real Redirect-vserver name no redirect-vserver Redirect-vserver real server submodeTraffic is not redirected to the server Weight real server submode Weight weighting-value no weightWeighting value default is Predictor serverfarm submode Redirect-vserver This example shows how to name the virtual serverRedirect-vserver name no redirect-vserver name Advertise redirect virtual server submode Advertise active no advertiseActive Advertise virtual server submode SLB redirect virtual server configuration submode Client redirect virtual server submodeExclude Optional Specifies that the IP address is disallowed Idle redirect virtual server submode Idle durationNo idle Redirect-vserver real server submode Inservice No inservice Inservice redirect virtual server submodeRedirect-vserver Show module csm vserver redirect Replicate csrp No replicate csrp Replicate csrp redirect virtual server submodeVserver Ssl redirect virtual server submode No sslHttps Ftp Virtual redirect virtual server submode No virtual vipaddressRedirect-vserver real server submode Show module csm vserver redirect Show module csm sticky Vlan redirect virtual server submodeSticky Sticky-group policy submode Webhost backup redirect virtual server submode Webhost backup backup-string301 No webhost backup301 302 Webhost relocation redirect virtual server submode Reverse-sticky group-idno reverse-sticky Reverse-stickySticky Sticky-group policy submode Script file No script file Related Commands show module csm script Script task 100Script name Show module csm script Serverfarm Serverfarm serverfarm-name No serverfarm serverfarm-name SLB serverfarm configuration submode Bindid serverfarm submodeBindid bind-idno bindid Dfp This example shows how to add a description CSM release This command was introducedCat6k-2config-slb-sfarm#description Backup Server Farm Backup real real server submode Failaction serverfarm submodeFailaction purge reassign No failaction purge reassign Purge Dfp Script task Show module csm serverfarm Health serverfarm submode100 Nat client client-pool-name static Nat client serverfarm submode101 Nat server serverfarm submode Nat server source-macno nat serverSource-mac 102 Predictor serverfarm submode 103 104 105 Probe serverfarm submode 106 Retcode-map serverfarm submode Retcode-mapretcodemapname no retcode-mapMap retcode Script task Show module csm serverfarm This example shows how to display static data Show module csmReal static NAT submode Static Mode rp only Related Commands arpShow module csm arp Show module csm slot arp Show module csm capp Show module csm capp udp detailsSyntax Description 110 111 State Explanation Show module csm conns112 Related Commands module csm SynsrvReqwait 113 Weights Show module csm dfpAgent Manager 115 Mode rp only Show module csm ftShow module csm slot ft detail 116 Show module csm map UrlHeader Name This example shows how to display return code maps Related Commands map cookieMap header map url module csm 118 Show module csm memory Show module csm slot memory vserver vserver-name detailParse-length virtual server submode 119 Ip slb mode rp only Show module csm natpoolShow module csm slot natpool name pool-name detail Natpool module CSM submode Show module csm owner Show module csm slot owner name owner-name detailOwner virtual server submode 121 Slb mode rp only Show module csm policyShow module csm slot policy name policy-name 122 Show module csm probe 123 Probe serverfarm submode 124 Show module csm probe script Show module csm slot probe script name probe-name detailProbe serverfarm submode script probe submode 125 Show module csm pvlan Show module csm slot pvlan126 Cat6k-2#show module csm 4 pvlan Show module csm real Show module csm slot real sfarm sfarm-name detailSfarm This example shows Cisco IOS SLB real server data Field Description 128 Show module csm real retcode Show module csm slot real retcode sfarm sfarm-name detail129 Cat6k-2#show module csm 5 real retcode Show module csm script Show module csm slot script name fullfileURL codeCode 130 This example shows how to display a running script Show module csm script taskShow module csm slot script task index script-index detail Index For ip slb mode rp only Show module csm serverfarmShow module csm slot serverfarm name serverfarm-name detail 132 Field Redirect Bind id133 Cat6k-2#show mod csm 5 serverfarm detail Show module csm static DropNat Virtual Pass-through Show module csm static server135 Real static NAT submode static 136 This example shows how to display SLB statistics Show module csm statsShow module csm slot stats Statistics counters are 32-bit 3describes the fields in the display 138 This example shows how to display CSM status Show module csm statusShow module csm slot status 139 Show module csm sticky Show module csm slot sticky groups client ipaddressGroups 140 Sticky Sticky virtual server submode 4describes the fields in the display141 Show module csm tech-script Show module csm slot tech-script142 Cat6k-2#show module csm 4 tech-script Show module csm tech-support 143 144 Cat6k-2#show module csm 4 tech-support processor 145 Variable command Show module csm variableShow module csm slot variable name name detail 146 147 Csm slot variable detail commandCat6k-2#show module csm 5 variable detail Show module csm vlan ClientServer Vlan-id Related Commands vlan virtual server submode 149 Redirect for ip slb mode rp only This example shows how to display the CSM virtual serversShow module csm vserver redirect Show module csm slot vserver redirect 151 This example shows how to display the CSM XML statistics Related Commands xml-configShow module csm xml stats Show module csm xml stats Snmp enable traps slb ft Snmp enable traps slb ft no snmp enable traps slb ftActive after detecting a failure in its fault tolerant peer This example shows how to enable fault tolerant traps Static Nat client serverfarm submodeShow module csm static 154 SLB static NAT configuration submode Real static NAT submodeShow module csm static Static Sticky 156 Routerconfig-module-csm#variable Notimeoutipstickyentries Cat6k-2config-module-csm#sticky 5 header headername timeout157 Cookie offset sticky submode No cookie offsetOffset offset Length length This example shows how to specify a secondary sticky entry Cookie secondary sticky submodeCookie secondary name no cookie secondary Name Specifies a cookie name Header sticky submode Header offset value length valueOffset value Length value Static sticky submode 161 Vserver 162 Advertise virtual server submode Server as host routeRedirect-vserver 163 Client virtual server submode Ip access-list standard164 Related Commands vserver Cat6k-2config-slb-vserver#description Backup Server FarmDescription virtual server submode 165 Domain virtual server submode This example shows how to set a domain name166 Idle virtual server submode This example shows how to specify an idle timer duration167 Virtual server is not in service Inservice virtual server submode168 Owner virtual server submode No owner maxconnsMaxconns Advertise virtual server submode Default is SLB virtual server configuration submode Parse-length virtual server submodeParse-length bytes No parse-length Bytes Number of bytes the range is from 1 to Pending timeout no pending Default pending timeout is 30 secondsPending virtual server submode 171 This example shows how to enable the Http 1.1 persistence Persistent rebalance virtual server submodePersistent rebalance No persistent rebalance 172 Replicate csrp virtual server submode StickyConnection 173 Reverse-sticky group-id No reverse-sticky Reverse-sticky virtual server submode174 Backup Threshold outservice realvalue inservice realvalue optionsServerfarm command Serverfarm virtual server submode Serverfarm policy submode Command176 Slb-policy virtual server submode Slb-policypolicy-name priority priorityvalueNo slb-policy policy-name 177 Ssl-sticky virtual server submode Ssl-sticky offset X length Y No ssl-stickyOffset Length Status-tracking virtual server submode Status-tracking vservernameVservername Identifies the dependent virtual server 179 Sticky virtual server submode 180 Reverse-sticky virtual server submode For connection coupling181 No default unidirectional DefaultRelated Commands show module csm vserver redirect Unidirectional virtual server submode Predictor serverfarm submode Url-hash virtual server submode183 Virtual virtual server submode 184 185 186 Vlan virtual server submode No vlanShow module csm vlan Vlan virtual server submode 187 Vlan Vlan vlan-numberclient server No vlanClient server 188 Alias Vlan submode Alias ip-address netmask No alias ip-address netmaskVlan Netmask Related Commands show module csm vlan vlan XML submode 190 Description Vlan submode Ip address Vlan submode SLB Vlan configuration submode191 Gateway Vlan submode Gateway ip-addressno gateway ip-addressShow module csm vlan Vlan virtual server submode 192 Ip address Vlan submode No ip addressAlt 193 Route Vlan submode GatewayGw-ip-address 194 Xml-config Xml-config no xml-configClient-group XML submode Credentials XML submode Vlan XML submode Xml-config Client-group XML submodeClient-group 1-99name 196 Credentials user-name password Credentials XML submodeNo credentials user-name Client-group XML submode Inservice XML submode Defaults Command ModesThis example shows how to enable XML Xml-config Port XML submode Port port-numberNo port Port-number Sets the CSM port Vlan XML submode Vlan id no vlanVlan name All VLANs are accepted Commands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy service Ssl-proxy vlan Clear ssl-proxy conn service name Service nameSsl-proxy connection command without options Clear ssl-proxy conn Clear ssl-proxy session service name Clear ssl-proxy session Clear ssl-proxy stats Crypto ca export pem TerminalDes 3des Importing CA certificate Exportable Crypto ca import pemUsage-keys Crypto ca export pem Tftp Crypto ca export pkcs12Pkcs12filename Page Crypto ca import pkcs12 Filename TP2? /users/admin-1/pkcs12/TP2.p12 This example shows how to import a PKCS12 file using SCPCrypto Keylabel Name of the key Crypto key export rsa pemOptional Specifies that the key can be exported Key nametest-keys UsageGeneral Purpose Key Crypto key import rsa pem Instead of one general-purpose key pairNull-Imports from the null file system System-Imports from the system file system Examples Debug ssl-proxy This example shows how to turn on App debugging This example shows how to turn on FDU debuggingThis example shows how to turn on IPC debugging This example shows how to turn on PKI debugging This example shows how to turn on TCP debugging This example shows how to turn off TCP debuggingSsl-proxy#debug ssl-proxy tcp Ssl-proxy#no debug ssl-proxy tcp Command EXEC-level command to be executed Do commandConfiguration mode Show ssl-proxy admin-info Show ssl-proxy admin-infoSsl-proxy#show ssl-proxy admin-info This command has no default settings Show ssl-proxy buffersShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffers Show ssl-proxy certificate-history service name Service nameOptionally for a specific proxy service Show ssl-proxy certificate-history Ssl-proxy# show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31 Related Commands ssl-proxy service Show ssl-proxy conn service name Show ssl-proxy conn4tuple Remote Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Show ssl-proxy crash-info Show ssl-proxy crash-info brief detailsBrief Limited to processor registers Stack top Printing 1024 bytes from stack top Ssl-proxy#show ssl-proxy crash-info brief Show ssl-proxy mac address Show ssl-proxy mac addressModule with SSL Ssl-proxy#show ssl-proxy mac address Show ssl-proxy natpool Show ssl-proxy natpool nameName Optional NAT pool name Ssl-proxy#show ssl-proxy natpool NP1 Show ssl-proxy policy Show ssl-proxy policy http-header ssl tcp url-rewrite nameHttp-header Url-rewrite MSS Show ssl-proxy service Show ssl-proxy service nameName Optional Service name Ssl-proxy#show ssl-proxy service Proxy status No Client VLAN, No Server Vlan Ssl-proxy# Show ssl-proxy stats type Show ssl-proxy statsStats This example shows how to display the PKI statistics Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage Counters This example shows how to display the FDU statistics Ssl-proxy# show ssl-prox stats fdu Show ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Show ssl-proxy version Show ssl-proxy versionSsl-proxy#show ssl-proxy version Show ssl-proxy vlan Show ssl-proxy vlan vlan-iddebugDebug Optional Displays debug information Show ssl-proxy vts This command has no default settings Exec modeSsl-proxy#show ssl-proxy vlan Snmp-server enable Defaults Command Modes Command History Examples Seconds Global configuration This example shows how to start a cryptographic self-testSsl-proxy crypto selftest Time-interval Ssl-proxy mac address Related Commands show ssl-proxy mac addressSsl-proxy mac address mac-addr Related Commands show ssl-proxy natpool This example shows how to define a pool of IP addressesSsl-proxy natpool Ssl-proxy pki This example shows how to enable PKI event-history This example shows how to specify the cache sizeRelated Commands show ssl-proxy stats Ssl-proxy policy http-header http-header-policy-name Ssl-proxy policy http-headerHttp-header-policy-name Http header policy name Custom custom-string Timeout session timeout absolute Ssl-proxy policy sslSsl-proxy policy ssl ssl-policy-name Ssl-policy-name SSL policy name RSAWITHRC4128SHA all No close-protocol enable Default cipher close-protocolNo session-cache enable Timeout handshake timeout This example shows how to enable session-cache This example shows how to disable session-cacheSsl-proxy config# ssl-proxy policy ssl sslpl1 Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHA This example shows how to print out a help Defaults are as follows Timeout reassembly is 60 secondsSsl-proxy policy tcp Ssl-proxy policy tcp tcp-policy-name No timeout syn timeout-in-seconds No timeout reassembly timeNo buffer-share rx buffer-limit-in-bytes No buffer-share tx buffer-limit-in-bytes Related Commands show ssl-proxy policy Ssl-proxy policy url-rewrite Ssl-proxy policy url-rewrite url-rewrite-policy-name Ssl-proxy config# ssl-proxy policy url-rewrite test1 Ssl-proxyconfig-url-rewrite-policy# This command has no arguments or keywords Ssl-proxy pool caSsl-proxy pool ca-pool-name Ca-pool-name Certificate authority pool name Ssl-proxy service Ssl-proxy service ssl-proxy-nameclientSsl-proxy service client command Protocol protocol port portno subcommand Authenticate verify all signature-only Default certificate inservice nat serverInservice Certificate rsa general-purpose trustpoint Ssl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Exits from proxy-client configuration submode Ssl-proxy service clientDeclares a proxy client as administratively up Ssl-proxy config# ssl-proxy service S7 client Sslv2 keyword enables SSL versionApplies a URL rewrite policy to the proxy server Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxy config# ssl-proxy ssl ratelimit Ssl-proxy config# no ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxyy ssl ratelimit Admin Ssl-proxy vlanSsl-proxy vlan vlan Gateway prefix drop forward1 Standby authentication Standby delay minimum reloadStandby ip Standby mac-address Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gateway Ssl-proxyconfig-vlan#ipaddr 208.59.100.18Ssl-proxyconfig-vlan#ipaddr 10.1.0.20 Related Commands show ssl-proxy vlan Standby authentication Group-number is String is cisco Standby delay minimum reload Min-delay is 1 second Reload-delay is 5 seconds Show standby delay Ssl-proxyconfig-vlan#standby delay minimum 30 reload Hsrp is disabled by default Proxy-VLAN configuration submodeStandby ip Secondary Used by the hot standby group is learned using Hsrp Standby mac-address Standby group-numbermac-addressmac-addressNo standby group-numbermac-address Mac-address MAC address That is used in the end nodes Ssl-proxyconfig-vlan#standby 1 mac-addressShow standby Standby mac-refresh Standby mac-refresh seconds no standby mac-refresh Hsrp is disabled Standby nameStandby name group-name No standby name group-name Group-name Specifies the name of the standby group Delay Minimum delayReload delay Sync delay Operation returns to the default behavior Leaves any synchronization delay if it was configuredSsl-proxyconfig-vlan#standby preempt delay minimum Clients This example shows how to change the router priority Standby priorityStandby group-numberpriority priority No standby group-numberpriority priority Standby track Enable DisableTimers Standby redirects Ssl-proxyconfig-vlan#standby redirects timers 90 Related Commands show standbyShow standby redirect Standby timers Msec Interface ethernet Command commands and take action when the object changes Standby trackDecrement priority Back up Router a Configuration Router B ConfigurationRelated Commands standby preempt Standby priority Standby use-bia scope interface No standby use-bia Standby use-biaScope interface OL-7029-01 Acronym Expansion Cbac CCACDP CEF Dram DsapDscp Dspu ICD IcmpIDB IDP MD5 MdixMdss MFD OSI OSMOspf PAE Rmon ROMRommon RPC STP SVCSVI TACACS+ Weighted round-robin WRRXNS Xerox Network System OL-7029-01 Capp UDP HttpCapp IN-1 XML NATIN-2 IN-3 See FTP FTPGslb IN-4 Secondary interface IN-5 Pool addresses ConfigurationIN-6 Gslb Http IN-7 Real server Backup Enabling IN-8 Smtp IN-9 URL TCPIN-10 IN-11 Credentials Enabling Port Statistics display Vlan IN-12