Cisco Systems OL-7029-01 instruction

Chapter 3 Commands Specific to the Content Switching Module with SSL

show ssl-proxy service

Proxy status: No Client VLAN, No Server VLAN

ssl-proxy#

Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

	OL-7029-01	3-39

Page 261

Image 261

Cisco Systems OL-7029-01 manual Proxy status No Client VLAN, No Server Vlan Ssl-proxy#

Contents

Text Part Number OL-7029-01 Corporate HeadquartersPage Iii N T E N T S Hw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Vii Show module csm static server Viii Vlan virtual server submode Ssl-proxy policy url-rewrite Acronyms A-1 Audience OrganizationChapter Title Description Convention Description ConventionsBoldface font Boldface Related Documentation Obtaining DocumentationXiii Cisco Product Security Overview Documentation FeedbackCisco Ordering tool Cisco Marketplace Xiv An emergency, you can also reach Psirt by telephone 877 408 Obtaining Technical Assistance Xvi Submitting a Service Request Xvii Obtaining Additional Publications and Information Xviii Command Task Using Content Switching Module Commands # prompt is displayed Command Modes Regular Expressions Submodes When you are in a submode, the prompt changes toExpression Meaning Zero or more characters Backspace Ascii Alert AsciiForm-feed Ascii Newline Ascii Content Switching Module with SSL Commands Arp Defaults Command Modes Command HistoryVlan id Release Modification Command Modes Command History Syntax Description DefaultsCapp udp Capp udp No capp udp Related Commands port Capp UDP submode Options Capp UDP submode Related Commands capp udpNo options ipaddress Encryption MD5 Port Capp UDP submode This example shows how to set the port for Capp connectionsPort portnum no port Capp udp Secure No secure Secure Capp UDP submode Clear module csm No dfp password password PasswordDfp Related Commands show module csm dfp Agent DFP submode DfpManager DFP submode Show module csm dfp Manager DFP submode Syntax Description Defaults Command ModesManager port No manager Agent DFP submode Exit Exit Ft group Module CSM configuration submodeFt group group-id vlan vlan number No ft group Heartbeat-time fault tolerant submode Failover fault tolerant submodePreempt fault tolerant submode Priority fault tolerant submode Failover failover-time Failover fault tolerant submodeNo failover Ft group Heartbeat-time heartbeat-timeno heartbeat-time Heartbeat-time fault tolerant submodeFt group Show module csm ft Preempt fault tolerant submode Related Commands ft groupPreempt No preempt Priority value alt value No priority Alt Priority fault tolerant submodeCSM Value Preempt fault tolerant submode Track fault tolerant submode Hw-module csm slot standby config-sync Hw-module csm standby config-syncSyntax Description Defaults Command Modes Command History Ip address Vlan submode priority fault tolerant submode Ip slb mode csm rp no ip slb mode Csm Ip slb modeOn the Catalyst 6500 series switch Keyword to select the route processor Cisco IOS SLB mode Module csm Show ip slb mode Cookie Map cookieCookie-map policy submode Match protocol http cookie cookie map submode Match protocol http cookie cookie map submode Cookie-valueMap cookie Show module csm map This example shows how to group DNS domains DNS domains can be configured to a mapMap dns Match protocol dns domain DNS map submode This example shows how to add domains to a DNS map SLB DNS map configuration submodeMatch protocol dns domain DNS map submode Name Names the DNS domain being mapped Map name header no map name Map headerHeader-map policy submode Insert protocol http header header map submode Insert protocol http header header map submode Header-value valueHeader-map policy submode map header Show module csm map Match protocol http header header map submode SLB header map configuration submodeHeader-value expression Must be matched This command has no default settings CSM module submode Keyword to enter the return error code map submodeMap retcode Map name retcode No map name Match protocol http retcode return code map submode Map retcode SLB policy configuration submodeAction count Action log Map url-map-name url no map url-map-name Map urlUrl-map-name Match protocol http url URL map submode Usage Guidelines Examples Related Commands SLB URL map configuration submodeMatch protocol http url URL map submode Map url Show module csm map url-map policy submode Ip slb mode Slot-number Slot number where the CSM residesModule csm Module csm slot-number No module csm slot-number Netmask netmask Natpool module CSM submodeNat client serverfarm submode Show module csm natpool Name Default Valid Values Description Variable module CSM submodeVariable name value no variable name Noresetunidirectionalflows AggregatebackupsfstatetovSwitchoverrpaction Advertiserhifreq Show module csm variable Owner name no owner OwnerBilling-info owner submode Contact-info owner submode Maxconns owner submode Billing-infobilling-address-information Billing-info owner submodeNo billing-info Contact-info owner submode Contact-info owner submode Contact-info string no contact-infoString Owner’s information Maxconns number no maxconns Maxconns owner submodeNumber Number of maximum connections to the owner object Accept further connections Policy All policies should be configured with a server farmPolicy policy-name no policy policy-name Show module csm owner Client-group policy submode Ip access-list standardNo client-group Policy Show module csm owner Cookie-mapcookie-map-name Cookie-map policy submodeNo cookie-map Map cookie Header-map policy submode Specified in the map header commandHeader-map name No header-map Map header No nat client Nat client policy submodeStatic Natpool module CSM submode Serverfarm policy submode Serverfarm virtual server submode Policy Set ip dscp policy submode Default is that the CSM does not store Dscp valuesSet ip dscp dscp-valueno set ip dscp Dscp-value Range is from 0 to Sticky-group policy submode This example shows how to configure a sticky groupSticky-group group-id No sticky-group Show module csm owner Show module csm sticky Sticky Url-map policy submode Default is no URL mapUrl-mapurl-map-name no url-map Map url Probe Show module csm probe Probe No address ip-address Address probe submodeRouted Probe SLB Http probe configuration submode Credentials username passwordThis command is for Http probes Credentials probe submode Description serverfarm submode Description line No descriptionLine Description text Expect status probe submode Enter the no expect status 34 99 command Related Commands probe This command is used for all probe types Default value for the failed interval is 300 secondsFailed probe submode Failed failed-interval no failed Header field-name field-value Header probe submodeNo header field-name Probe Show module csm probe Interval seconds no interval Interval probe submode SLB DNS probe configuration submode Name probe submodeName domain-name no name Default value for the open timeout is 10 seconds Open open-timeout no openSLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Open probe submode Port probe submode Default value for the port number isPort port-number no port Port-number Sets the port number Default value for a receive timeout is 10 seconds Receive receive-timeout no receiveThis command is available for all probe types except TCP Receive probe submode Recover recovervalue no recover Recover probe submodeDefault value is This command is available for all probe types Method get Request probe submodeMethod head Url path Default value for retries is Retries probe submodeRetries retry-count no retries Script scriptname Script probe submodeScriptname Specifies a probe script Failed probe submode SLB serverfarm configuration submode Default is no port translation for the real serverReal Real ip-address port local No real ip-address port Cat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Backup real ip name name port no backup real Backup real real server submodeName name Failaction serverfarm submode Health probe probe-nametag string Health probe real server submodeNo health probe Tag Inservice standby No inservice Standby Inservice real server submodeCommand History Release Modification Real Show module csm real Maxconns max-conns no maxconns Maxconns real server submodeReal server falls below Minconns Minconns real server submode Minconns real server submode Default value is the set minumum number of connectionsMinconns min-consno minconns Maxconns real server submode real Show module csm real Redirect-vserver real server submode Redirect-vserver name no redirect-vserverTraffic is not redirected to the server Weight weighting-value no weight Weight real server submodeWeighting value default is Predictor serverfarm submode This example shows how to name the virtual server Redirect-vserverRedirect-vserver name no redirect-vserver name Advertise active no advertise Advertise redirect virtual server submodeActive Advertise virtual server submode Client redirect virtual server submode SLB redirect virtual server configuration submodeExclude Optional Specifies that the IP address is disallowed Idle duration Idle redirect virtual server submodeNo idle Redirect-vserver real server submode Inservice redirect virtual server submode Inservice No inserviceRedirect-vserver Show module csm vserver redirect Replicate csrp redirect virtual server submode Replicate csrp No replicate csrpVserver No ssl Ssl redirect virtual server submodeHttps Ftp No virtual vipaddress Virtual redirect virtual server submodeRedirect-vserver real server submode Show module csm vserver redirect Vlan redirect virtual server submode Show module csm stickySticky Sticky-group policy submode Webhost backup backup-string301 No webhost backup Webhost backup redirect virtual server submode301 302 Webhost relocation redirect virtual server submode Reverse-sticky Reverse-sticky group-idno reverse-stickySticky Sticky-group policy submode No script file Script file Related Commands show module csm script 100 Script taskScript name Show module csm script Serverfarm serverfarm-name No serverfarm serverfarm-name Serverfarm Bindid serverfarm submode SLB serverfarm configuration submodeBindid bind-idno bindid Dfp CSM release This command was introduced This example shows how to add a descriptionCat6k-2config-slb-sfarm#description Backup Server Farm Failaction serverfarm submode Backup real real server submodeFailaction purge reassign No failaction purge reassign Purge Health serverfarm submode Dfp Script task Show module csm serverfarm100 Nat client serverfarm submode Nat client client-pool-name static101 Nat server source-macno nat server Nat server serverfarm submodeSource-mac 102 103 Predictor serverfarm submode 104 105 106 Probe serverfarm submode Retcode-mapretcodemapname no retcode-map Retcode-map serverfarm submodeMap retcode Script task Show module csm serverfarm Show module csm This example shows how to display static dataReal static NAT submode Static Related Commands arp Mode rp onlyShow module csm arp Show module csm slot arp Show module csm capp udp details Show module csm cappSyntax Description 110 111 Show module csm conns State Explanation112 Synsrv Related Commands module csmReqwait 113 Show module csm dfp WeightsAgent Manager 115 Show module csm ft Mode rp onlyShow module csm slot ft detail 116 Url Show module csm mapHeader Name Related Commands map cookie This example shows how to display return code mapsMap header map url module csm 118 Show module csm slot memory vserver vserver-name detail Show module csm memoryParse-length virtual server submode 119 Show module csm natpool Ip slb mode rp onlyShow module csm slot natpool name pool-name detail Natpool module CSM submode Show module csm slot owner name owner-name detail Show module csm ownerOwner virtual server submode 121 Show module csm policy Slb mode rp onlyShow module csm slot policy name policy-name 122 123 Show module csm probe 124 Probe serverfarm submode Show module csm slot probe script name probe-name detail Show module csm probe scriptProbe serverfarm submode script probe submode 125 Show module csm slot pvlan Show module csm pvlan126 Cat6k-2#show module csm 4 pvlan Show module csm slot real sfarm sfarm-name detail Show module csm realSfarm This example shows Cisco IOS SLB real server data 128 Field Description Show module csm slot real retcode sfarm sfarm-name detail Show module csm real retcode129 Cat6k-2#show module csm 5 real retcode Show module csm slot script name fullfileURL code Show module csm scriptCode 130 Show module csm script task This example shows how to display a running scriptShow module csm slot script task index script-index detail Index Show module csm serverfarm For ip slb mode rp onlyShow module csm slot serverfarm name serverfarm-name detail 132 Redirect Bind id Field133 Cat6k-2#show mod csm 5 serverfarm detail Drop Show module csm staticNat Virtual Show module csm static server Pass-through135 136 Real static NAT submode static Show module csm stats This example shows how to display SLB statisticsShow module csm slot stats Statistics counters are 32-bit 138 3describes the fields in the display Show module csm status This example shows how to display CSM statusShow module csm slot status 139 Show module csm slot sticky groups client ipaddress Show module csm stickyGroups 140 4describes the fields in the display Sticky Sticky virtual server submode141 Show module csm slot tech-script Show module csm tech-script142 Cat6k-2#show module csm 4 tech-script 143 Show module csm tech-support Cat6k-2#show module csm 4 tech-support processor 144 145 Show module csm variable Variable commandShow module csm slot variable name name detail 146 Csm slot variable detail command 147Cat6k-2#show module csm 5 variable detail Client Show module csm vlanServer Vlan-id 149 Related Commands vlan virtual server submode This example shows how to display the CSM virtual servers Redirect for ip slb mode rp onlyShow module csm vserver redirect Show module csm slot vserver redirect 151 Related Commands xml-config This example shows how to display the CSM XML statisticsShow module csm xml stats Show module csm xml stats Snmp enable traps slb ft no snmp enable traps slb ft Snmp enable traps slb ftActive after detecting a failure in its fault tolerant peer This example shows how to enable fault tolerant traps Nat client serverfarm submode StaticShow module csm static 154 Real static NAT submode SLB static NAT configuration submodeShow module csm static Static 156 Sticky Cat6k-2config-module-csm#sticky 5 header headername timeout Routerconfig-module-csm#variable Notimeoutipstickyentries157 No cookie offset Cookie offset sticky submodeOffset offset Length length Cookie secondary sticky submode This example shows how to specify a secondary sticky entryCookie secondary name no cookie secondary Name Specifies a cookie name Header offset value length value Header sticky submodeOffset value Length value 161 Static sticky submode 162 Vserver Server as host route Advertise virtual server submodeRedirect-vserver 163 Ip access-list standard Client virtual server submode164 Cat6k-2config-slb-vserver#description Backup Server Farm Related Commands vserverDescription virtual server submode 165 This example shows how to set a domain name Domain virtual server submode166 This example shows how to specify an idle timer duration Idle virtual server submode167 Inservice virtual server submode Virtual server is not in service168 No owner maxconns Owner virtual server submodeMaxconns Advertise virtual server submode Parse-length virtual server submode Default is SLB virtual server configuration submodeParse-length bytes No parse-length Bytes Number of bytes the range is from 1 to Default pending timeout is 30 seconds Pending timeout no pendingPending virtual server submode 171 Persistent rebalance virtual server submode This example shows how to enable the Http 1.1 persistencePersistent rebalance No persistent rebalance 172 Sticky Replicate csrp virtual server submodeConnection 173 Reverse-sticky virtual server submode Reverse-sticky group-id No reverse-sticky174 Threshold outservice realvalue inservice realvalue options BackupServerfarm command Serverfarm virtual server submode Command Serverfarm policy submode176 Slb-policypolicy-name priority priorityvalue Slb-policy virtual server submodeNo slb-policy policy-name 177 Ssl-sticky offset X length Y No ssl-sticky Ssl-sticky virtual server submodeOffset Length Status-tracking vservername Status-tracking virtual server submodeVservername Identifies the dependent virtual server 179 180 Sticky virtual server submode For connection coupling Reverse-sticky virtual server submode181 Default No default unidirectionalRelated Commands show module csm vserver redirect Unidirectional virtual server submode Url-hash virtual server submode Predictor serverfarm submode183 184 Virtual virtual server submode 185 186 No vlan Vlan virtual server submodeShow module csm vlan Vlan virtual server submode 187 Vlan vlan-numberclient server No vlan VlanClient server 188 Alias ip-address netmask No alias ip-address netmask Alias Vlan submodeVlan Netmask 190 Related Commands show module csm vlan vlan XML submode Ip address Vlan submode SLB Vlan configuration submode Description Vlan submode191 Gateway ip-addressno gateway ip-address Gateway Vlan submodeShow module csm vlan Vlan virtual server submode 192 No ip address Ip address Vlan submodeAlt 193 Gateway Route Vlan submodeGw-ip-address 194 Xml-config no xml-config Xml-configClient-group XML submode Credentials XML submode Vlan XML submode Client-group XML submode Xml-configClient-group 1-99name 196 Credentials XML submode Credentials user-name passwordNo credentials user-name Client-group XML submode Defaults Command Modes Inservice XML submodeThis example shows how to enable XML Xml-config Port port-number Port XML submodeNo port Port-number Sets the CSM port Vlan id no vlan Vlan XML submodeVlan name All VLANs are accepted Commands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy vlan Ssl-proxy service Service name Clear ssl-proxy conn service nameSsl-proxy connection command without options Clear ssl-proxy conn Clear ssl-proxy session Clear ssl-proxy session service name Clear ssl-proxy stats Terminal Crypto ca export pemDes 3des Importing CA certificate Crypto ca import pem ExportableUsage-keys Crypto ca export pem Crypto ca export pkcs12 TftpPkcs12filename Page Crypto ca import pkcs12 This example shows how to import a PKCS12 file using SCP Filename TP2? /users/admin-1/pkcs12/TP2.p12Crypto Crypto key export rsa pem Keylabel Name of the keyOptional Specifies that the key can be exported Key nametest-keys UsageGeneral Purpose Key Instead of one general-purpose key pair Crypto key import rsa pemNull-Imports from the null file system System-Imports from the system file system Examples Debug ssl-proxy This example shows how to turn on FDU debugging This example shows how to turn on App debuggingThis example shows how to turn on IPC debugging This example shows how to turn on PKI debugging This example shows how to turn off TCP debugging This example shows how to turn on TCP debuggingSsl-proxy#debug ssl-proxy tcp Ssl-proxy#no debug ssl-proxy tcp Do command Command EXEC-level command to be executedConfiguration mode Show ssl-proxy admin-info Show ssl-proxy admin-infoSsl-proxy#show ssl-proxy admin-info Show ssl-proxy buffers This command has no default settingsShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffers Service name Show ssl-proxy certificate-history service nameOptionally for a specific proxy service Show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31 Ssl-proxy# show ssl-proxy certificate-history Related Commands ssl-proxy service Show ssl-proxy conn Show ssl-proxy conn service name4tuple Remote Ssl-proxy#show ssl-proxy conn 200.200.1438814 58796 Show ssl-proxy crash-info brief details Show ssl-proxy crash-infoBrief Limited to processor registers Ssl-proxy#show ssl-proxy crash-info brief Stack top Printing 1024 bytes from stack top Show ssl-proxy mac address Show ssl-proxy mac addressModule with SSL Ssl-proxy#show ssl-proxy mac address Show ssl-proxy natpool name Show ssl-proxy natpoolName Optional NAT pool name Ssl-proxy#show ssl-proxy natpool NP1 Show ssl-proxy policy http-header ssl tcp url-rewrite name Show ssl-proxy policyHttp-header Url-rewrite MSS Show ssl-proxy service name Show ssl-proxy serviceName Optional Service name Ssl-proxy#show ssl-proxy service Proxy status No Client VLAN, No Server Vlan Ssl-proxy# Show ssl-proxy stats Show ssl-proxy stats typeStats Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage Counters This example shows how to display the PKI statistics Ssl-proxy# show ssl-prox stats fdu This example shows how to display the FDU statistics Show ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Show ssl-proxy version Show ssl-proxy versionSsl-proxy#show ssl-proxy version Show ssl-proxy vlan vlan-iddebug Show ssl-proxy vlanDebug Optional Displays debug information This command has no default settings Exec mode Show ssl-proxy vtsSsl-proxy#show ssl-proxy vlan Defaults Command Modes Command History Examples Snmp-server enable This example shows how to start a cryptographic self-test Seconds Global configurationSsl-proxy crypto selftest Time-interval Related Commands show ssl-proxy mac address Ssl-proxy mac addressSsl-proxy mac address mac-addr This example shows how to define a pool of IP addresses Related Commands show ssl-proxy natpoolSsl-proxy natpool Ssl-proxy pki This example shows how to specify the cache size This example shows how to enable PKI event-historyRelated Commands show ssl-proxy stats Ssl-proxy policy http-header Ssl-proxy policy http-header http-header-policy-nameHttp-header-policy-name Http header policy name Custom custom-string Ssl-proxy policy ssl Timeout session timeout absoluteSsl-proxy policy ssl ssl-policy-name Ssl-policy-name SSL policy name Default cipher close-protocol RSAWITHRC4128SHA all No close-protocol enableNo session-cache enable Timeout handshake timeout This example shows how to disable session-cache This example shows how to enable session-cacheSsl-proxy config# ssl-proxy policy ssl sslpl1 Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHA This example shows how to print out a help Timeout reassembly is 60 seconds Defaults are as followsSsl-proxy policy tcp Ssl-proxy policy tcp tcp-policy-name No timeout reassembly time No timeout syn timeout-in-secondsNo buffer-share rx buffer-limit-in-bytes No buffer-share tx buffer-limit-in-bytes Related Commands show ssl-proxy policy Ssl-proxy policy url-rewrite url-rewrite-policy-name Ssl-proxy policy url-rewrite Ssl-proxyconfig-url-rewrite-policy# Ssl-proxy config# ssl-proxy policy url-rewrite test1 Ssl-proxy pool ca This command has no arguments or keywordsSsl-proxy pool ca-pool-name Ca-pool-name Certificate authority pool name Ssl-proxy service ssl-proxy-nameclient Ssl-proxy serviceSsl-proxy service client command Protocol protocol port portno subcommand Default certificate inservice nat server Authenticate verify all signature-onlyInservice Certificate rsa general-purpose trustpoint Ssl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Ssl-proxy service client Exits from proxy-client configuration submodeDeclares a proxy client as administratively up Sslv2 keyword enables SSL version Ssl-proxy config# ssl-proxy service S7 clientApplies a URL rewrite policy to the proxy server Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxy config# no ssl-proxy ssl ratelimit Ssl-proxy config# ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxyy ssl ratelimit Ssl-proxy vlan AdminSsl-proxy vlan vlan Gateway prefix drop forward1 Standby delay minimum reload Standby authenticationStandby ip Standby mac-address Ssl-proxyconfig-vlan#ipaddr 208.59.100.18 Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gatewaySsl-proxyconfig-vlan#ipaddr 10.1.0.20 Related Commands show ssl-proxy vlan Group-number is String is cisco Standby authentication Min-delay is 1 second Reload-delay is 5 seconds Standby delay minimum reload Ssl-proxyconfig-vlan#standby delay minimum 30 reload Show standby delay Proxy-VLAN configuration submode Hsrp is disabled by defaultStandby ip Secondary Used by the hot standby group is learned using Hsrp Standby group-numbermac-addressmac-address Standby mac-addressNo standby group-numbermac-address Mac-address MAC address Ssl-proxyconfig-vlan#standby 1 mac-address That is used in the end nodesShow standby Standby mac-refresh seconds no standby mac-refresh Standby mac-refresh Standby name Hsrp is disabledStandby name group-name No standby name group-name Group-name Specifies the name of the standby group Minimum delay DelayReload delay Sync delay Leaves any synchronization delay if it was configured Operation returns to the default behaviorSsl-proxyconfig-vlan#standby preempt delay minimum Clients Standby priority This example shows how to change the router priorityStandby group-numberpriority priority No standby group-numberpriority priority Standby track Disable EnableTimers Standby redirects Related Commands show standby Ssl-proxyconfig-vlan#standby redirects timers 90Show standby redirect Msec Standby timers Interface ethernet Standby track Command commands and take action when the object changesDecrement priority Back up Router B Configuration Router a ConfigurationRelated Commands standby preempt Standby priority Standby use-bia Standby use-bia scope interface No standby use-biaScope interface OL-7029-01 Acronym Expansion CCA CbacCDP CEF Dsap DramDscp Dspu Icmp ICDIDB IDP Mdix MD5Mdss MFD OSM OSIOspf PAE ROM RmonRommon RPC SVC STPSVI TACACS+ WRR Weighted round-robinXNS Xerox Network System OL-7029-01 Http Capp UDPCapp IN-1 NAT XMLIN-2 IN-3 FTP See FTPGslb IN-4 IN-5 Secondary interface Configuration Pool addressesIN-6 IN-7 Gslb Http IN-8 Real server Backup Enabling IN-9 Smtp TCP URLIN-10 IN-11 IN-12 Credentials Enabling Port Statistics display Vlan