Manuals / Cisco Systems / Computer Equipment / Switch

Cisco Systems OL-7029-01 manual

Models: OL-7029-01

1 342

Download 342 pages 1.49 Kb

Page 320

Image 320

Chapter 3 Commands Specific to the Content Switching Module with SSL

standby use-bia

Catalyst 6500 Series Switch Content Switching Module with SSL Command Reference

3-98	OL-7029-01

Page 320

Image 320

Contents

Corporate Headquarters Text Part Number OL-7029-01Page N T E N T S IiiHw-module csm standby config-sync2-21 Ip slb mode Map cookie Real Script file Show module csm static server ViiVlan virtual server submode ViiiSsl-proxy policy url-rewrite Acronyms A-1 Chapter Title Description AudienceOrganization Conventions Convention DescriptionBoldface font BoldfaceXiii Related DocumentationObtaining Documentation Documentation Feedback Cisco Product Security OverviewCisco Ordering tool Cisco Marketplace XivObtaining Technical Assistance An emergency, you can also reach Psirt by telephone 877 408Submitting a Service Request XviObtaining Additional Publications and Information XviiXviii Using Content Switching Module Commands Command TaskCommand Modes # prompt is displayedSubmodes When you are in a submode, the prompt changes to Regular ExpressionsExpression Meaning Zero or more charactersAlert Ascii Backspace AsciiForm-feed Ascii Newline AsciiContent Switching Module with SSL Commands Defaults Command Modes Command History ArpVlan id Release ModificationSyntax Description Defaults Command Modes Command HistoryCapp udp Capp udp No capp udpRelated Commands port Capp UDP submode Related Commands capp udp Options Capp UDP submodeNo options ipaddress Encryption MD5This example shows how to set the port for Capp connections Port Capp UDP submodePort portnum no port Capp udpSecure Capp UDP submode Secure No secureClear module csm Dfp No dfp password passwordPassword Related Commands show module csm dfp Manager DFP submode Show module csm dfp Agent DFP submodeDfp Syntax Description Defaults Command Modes Manager DFP submodeManager port No manager Agent DFP submodeExit ExitModule CSM configuration submode Ft groupFt group group-id vlan vlan number No ft groupFailover fault tolerant submode Heartbeat-time fault tolerant submodePreempt fault tolerant submode Priority fault tolerant submodeFailover fault tolerant submode Failover failover-timeNo failover Ft groupHeartbeat-time fault tolerant submode Heartbeat-time heartbeat-timeno heartbeat-timeFt group Show module csm ftPreempt No preempt Preempt fault tolerant submodeRelated Commands ft group Priority fault tolerant submode Priority value alt value No priority AltCSM ValueTrack fault tolerant submode Preempt fault tolerant submodeHw-module csm standby config-sync Hw-module csm slot standby config-syncSyntax Description Defaults Command Modes Command History Ip address Vlan submode priority fault tolerant submodeIp slb mode Ip slb mode csm rp no ip slb mode CsmOn the Catalyst 6500 series switch Keyword to select the route processor Cisco IOS SLB modeShow ip slb mode Module csmMap cookie CookieCookie-map policy submode Match protocol http cookie cookie map submodeMap cookie Show module csm map Match protocol http cookie cookie map submodeCookie-value DNS domains can be configured to a map This example shows how to group DNS domainsMap dns Match protocol dns domain DNS map submodeSLB DNS map configuration submode This example shows how to add domains to a DNS mapMatch protocol dns domain DNS map submode Name Names the DNS domain being mappedMap header Map name header no map nameHeader-map policy submode Insert protocol http header header map submodeHeader-map policy submode map header Show module csm map Insert protocol http header header map submodeHeader-value value SLB header map configuration submode Match protocol http header header map submodeHeader-value expression Must be matchedKeyword to enter the return error code map submode This command has no default settings CSM module submodeMap retcode Map name retcode No map nameMap retcode SLB policy configuration submode Match protocol http retcode return code map submodeAction count Action logMap url Map url-map-name url no map url-map-nameUrl-map-name Match protocol http url URL map submodeSLB URL map configuration submode Usage Guidelines Examples Related CommandsMatch protocol http url URL map submode Map url Show module csm map url-map policy submodeSlot-number Slot number where the CSM resides Ip slb modeModule csm Module csm slot-number No module csm slot-numberNatpool module CSM submode Netmask netmaskNat client serverfarm submode Show module csm natpoolVariable name value no variable name Name Default Valid Values DescriptionVariable module CSM submode Aggregatebackupsfstatetov NoresetunidirectionalflowsSwitchoverrpaction AdvertiserhifreqShow module csm variable Owner Owner name no ownerBilling-info owner submode Contact-info owner submode Maxconns owner submodeBilling-info owner submode Billing-infobilling-address-informationNo billing-info Contact-info owner submodeString Owner’s information Contact-info owner submodeContact-info string no contact-info Maxconns owner submode Maxconns number no maxconnsNumber Number of maximum connections to the owner object Accept further connectionsAll policies should be configured with a server farm PolicyPolicy policy-name no policy policy-name Show module csm ownerIp access-list standard Client-group policy submodeNo client-group Policy Show module csm ownerCookie-map policy submode Cookie-mapcookie-map-nameNo cookie-map Map cookieSpecified in the map header command Header-map policy submodeHeader-map name No header-map Map headerNat client policy submode No nat clientStatic Natpool module CSM submodeServerfarm policy submode Policy Serverfarm virtual server submodeDefault is that the CSM does not store Dscp values Set ip dscp policy submodeSet ip dscp dscp-valueno set ip dscp Dscp-value Range is from 0 toThis example shows how to configure a sticky group Sticky-group policy submodeSticky-group group-id No sticky-group Show module csm owner Show module csm sticky StickyDefault is no URL map Url-map policy submodeUrl-mapurl-map-name no url-map Map urlProbe Probe Show module csm probeAddress probe submode No address ip-addressRouted ProbeCredentials username password SLB Http probe configuration submodeThis command is for Http probes Credentials probe submodeLine Description text Description serverfarm submodeDescription line No description Enter the no expect status 34 99 command Expect status probe submodeRelated Commands probe Default value for the failed interval is 300 seconds This command is used for all probe typesFailed probe submode Failed failed-interval no failedHeader probe submode Header field-name field-valueNo header field-name Probe Show module csm probeInterval probe submode Interval seconds no intervalName domain-name no name SLB DNS probe configuration submodeName probe submode Open open-timeout no open Default value for the open timeout is 10 secondsSLB HTTP/TCP/FTP/Telnet/SMTP probe configuration submode Open probe submodeDefault value for the port number is Port probe submodePort port-number no port Port-number Sets the port numberReceive receive-timeout no receive Default value for a receive timeout is 10 secondsThis command is available for all probe types except TCP Receive probe submodeRecover probe submode Recover recovervalue no recoverDefault value is This command is available for all probe typesRequest probe submode Method getMethod head Url pathRetries retry-count no retries Default value for retries isRetries probe submode Script probe submode Script scriptnameScriptname Specifies a probe script Failed probe submodeDefault is no port translation for the real server SLB serverfarm configuration submodeReal Real ip-address port local No real ip-address portCat6k-2config-slb-sfarm# real Cat6k-2config-slb-real# Backup real real server submode Backup real ip name name port no backup realName name Failaction serverfarm submodeHealth probe real server submode Health probe probe-nametag stringNo health probe TagInservice real server submode Inservice standby No inservice StandbyCommand History Release Modification Real Show module csm realMaxconns real server submode Maxconns max-conns no maxconnsReal server falls below Minconns Minconns real server submodeDefault value is the set minumum number of connections Minconns real server submodeMinconns min-consno minconns Maxconns real server submode real Show module csm realTraffic is not redirected to the server Redirect-vserver real server submodeRedirect-vserver name no redirect-vserver Weight real server submode Weight weighting-value no weightWeighting value default is Predictor serverfarm submodeRedirect-vserver name no redirect-vserver name This example shows how to name the virtual serverRedirect-vserver Advertise redirect virtual server submode Advertise active no advertiseActive Advertise virtual server submodeSLB redirect virtual server configuration submode Client redirect virtual server submodeExclude Optional Specifies that the IP address is disallowedIdle redirect virtual server submode Idle durationNo idle Redirect-vserver real server submodeRedirect-vserver Show module csm vserver redirect Inservice redirect virtual server submodeInservice No inservice Vserver Replicate csrp redirect virtual server submodeReplicate csrp No replicate csrp Ssl redirect virtual server submode No sslHttps FtpVirtual redirect virtual server submode No virtual vipaddressRedirect-vserver real server submode Show module csm vserver redirectSticky Sticky-group policy submode Vlan redirect virtual server submodeShow module csm sticky Webhost backup redirect virtual server submode Webhost backup backup-string301 No webhost backup301 302Webhost relocation redirect virtual server submode Sticky Sticky-group policy submode Reverse-stickyReverse-sticky group-idno reverse-sticky Script file No script fileRelated Commands show module csm script Script task 100Script name Show module csm scriptServerfarm Serverfarm serverfarm-name No serverfarm serverfarm-nameSLB serverfarm configuration submode Bindid serverfarm submodeBindid bind-idno bindid DfpCat6k-2config-slb-sfarm#description Backup Server Farm CSM release This command was introducedThis example shows how to add a description Backup real real server submode Failaction serverfarm submodeFailaction purge reassign No failaction purge reassign Purge100 Health serverfarm submodeDfp Script task Show module csm serverfarm 101 Nat client serverfarm submodeNat client client-pool-name static Nat server serverfarm submode Nat server source-macno nat serverSource-mac 102Predictor serverfarm submode 103104 105 Probe serverfarm submode 106Retcode-map serverfarm submode Retcode-mapretcodemapname no retcode-mapMap retcode Script task Show module csm serverfarmThis example shows how to display static data Show module csmReal static NAT submode StaticMode rp only Related Commands arpShow module csm arp Show module csm slot arpShow module csm capp Show module csm capp udp detailsSyntax Description 110111 112 Show module csm connsState Explanation Related Commands module csm SynsrvReqwait 113Weights Show module csm dfpAgent Manager115 Mode rp only Show module csm ftShow module csm slot ft detail 116Show module csm map UrlHeader NameThis example shows how to display return code maps Related Commands map cookieMap header map url module csm 118Show module csm memory Show module csm slot memory vserver vserver-name detailParse-length virtual server submode 119Ip slb mode rp only Show module csm natpoolShow module csm slot natpool name pool-name detail Natpool module CSM submodeShow module csm owner Show module csm slot owner name owner-name detailOwner virtual server submode 121Slb mode rp only Show module csm policyShow module csm slot policy name policy-name 122Show module csm probe 123Probe serverfarm submode 124Show module csm probe script Show module csm slot probe script name probe-name detailProbe serverfarm submode script probe submode 125Show module csm pvlan Show module csm slot pvlan126 Cat6k-2#show module csm 4 pvlanShow module csm real Show module csm slot real sfarm sfarm-name detailSfarm This example shows Cisco IOS SLB real server dataField Description 128Show module csm real retcode Show module csm slot real retcode sfarm sfarm-name detail129 Cat6k-2#show module csm 5 real retcodeShow module csm script Show module csm slot script name fullfileURL codeCode 130This example shows how to display a running script Show module csm script taskShow module csm slot script task index script-index detail IndexFor ip slb mode rp only Show module csm serverfarmShow module csm slot serverfarm name serverfarm-name detail 132Field Redirect Bind id133 Cat6k-2#show mod csm 5 serverfarm detailShow module csm static DropNat Virtual135 Show module csm static serverPass-through Real static NAT submode static 136This example shows how to display SLB statistics Show module csm statsShow module csm slot stats Statistics counters are 32-bit3describes the fields in the display 138This example shows how to display CSM status Show module csm statusShow module csm slot status 139Show module csm sticky Show module csm slot sticky groups client ipaddressGroups 140141 4describes the fields in the displaySticky Sticky virtual server submode Show module csm tech-script Show module csm slot tech-script142 Cat6k-2#show module csm 4 tech-scriptShow module csm tech-support 143144 Cat6k-2#show module csm 4 tech-support processor145 Variable command Show module csm variableShow module csm slot variable name name detail 146Cat6k-2#show module csm 5 variable detail Csm slot variable detail command147 Show module csm vlan ClientServer Vlan-idRelated Commands vlan virtual server submode 149Redirect for ip slb mode rp only This example shows how to display the CSM virtual serversShow module csm vserver redirect Show module csm slot vserver redirect151 This example shows how to display the CSM XML statistics Related Commands xml-configShow module csm xml stats Show module csm xml statsSnmp enable traps slb ft Snmp enable traps slb ft no snmp enable traps slb ftActive after detecting a failure in its fault tolerant peer This example shows how to enable fault tolerant trapsStatic Nat client serverfarm submodeShow module csm static 154SLB static NAT configuration submode Real static NAT submodeShow module csm static StaticSticky 156157 Cat6k-2config-module-csm#sticky 5 header headername timeoutRouterconfig-module-csm#variable Notimeoutipstickyentries Cookie offset sticky submode No cookie offsetOffset offset Length lengthThis example shows how to specify a secondary sticky entry Cookie secondary sticky submodeCookie secondary name no cookie secondary Name Specifies a cookie nameHeader sticky submode Header offset value length valueOffset value Length valueStatic sticky submode 161Vserver 162Advertise virtual server submode Server as host routeRedirect-vserver 163164 Ip access-list standardClient virtual server submode Related Commands vserver Cat6k-2config-slb-vserver#description Backup Server FarmDescription virtual server submode 165166 This example shows how to set a domain nameDomain virtual server submode 167 This example shows how to specify an idle timer durationIdle virtual server submode 168 Inservice virtual server submodeVirtual server is not in service Owner virtual server submode No owner maxconnsMaxconns Advertise virtual server submodeDefault is SLB virtual server configuration submode Parse-length virtual server submodeParse-length bytes No parse-length Bytes Number of bytes the range is from 1 toPending timeout no pending Default pending timeout is 30 secondsPending virtual server submode 171This example shows how to enable the Http 1.1 persistence Persistent rebalance virtual server submodePersistent rebalance No persistent rebalance 172Replicate csrp virtual server submode StickyConnection 173174 Reverse-sticky virtual server submodeReverse-sticky group-id No reverse-sticky Backup Threshold outservice realvalue inservice realvalue optionsServerfarm command Serverfarm virtual server submode176 CommandServerfarm policy submode Slb-policy virtual server submode Slb-policypolicy-name priority priorityvalueNo slb-policy policy-name 177Ssl-sticky virtual server submode Ssl-sticky offset X length Y No ssl-stickyOffset LengthStatus-tracking virtual server submode Status-tracking vservernameVservername Identifies the dependent virtual server 179Sticky virtual server submode 180181 For connection couplingReverse-sticky virtual server submode No default unidirectional DefaultRelated Commands show module csm vserver redirect Unidirectional virtual server submode183 Url-hash virtual server submodePredictor serverfarm submode Virtual virtual server submode 184185 186 Vlan virtual server submode No vlanShow module csm vlan Vlan virtual server submode 187Vlan Vlan vlan-numberclient server No vlanClient server 188Alias Vlan submode Alias ip-address netmask No alias ip-address netmaskVlan NetmaskRelated Commands show module csm vlan vlan XML submode 190191 Ip address Vlan submode SLB Vlan configuration submodeDescription Vlan submode Gateway Vlan submode Gateway ip-addressno gateway ip-addressShow module csm vlan Vlan virtual server submode 192Ip address Vlan submode No ip addressAlt 193Route Vlan submode GatewayGw-ip-address 194Xml-config Xml-config no xml-configClient-group XML submode Credentials XML submode Vlan XML submodeXml-config Client-group XML submodeClient-group 1-99name 196Credentials user-name password Credentials XML submodeNo credentials user-name Client-group XML submodeInservice XML submode Defaults Command ModesThis example shows how to enable XML Xml-configPort XML submode Port port-numberNo port Port-number Sets the CSM portVlan XML submode Vlan id no vlanVlan name All VLANs are acceptedCommands Specific to the Content Switching Module with SSL Service module Commands Submode Commands Ssl-proxy service Ssl-proxy vlanClear ssl-proxy conn service name Service nameSsl-proxy connection command without options Clear ssl-proxy connClear ssl-proxy session service name Clear ssl-proxy sessionClear ssl-proxy stats Crypto ca export pem TerminalDes 3desImporting CA certificate Usage-keys Crypto ca import pemExportable Crypto ca export pem Pkcs12filename Crypto ca export pkcs12Tftp Page Crypto ca import pkcs12 Crypto This example shows how to import a PKCS12 file using SCPFilename TP2? /users/admin-1/pkcs12/TP2.p12 Optional Specifies that the key can be exported Crypto key export rsa pemKeylabel Name of the key Key nametest-keys UsageGeneral Purpose Key Crypto key import rsa pem Instead of one general-purpose key pairNull-Imports from the null file system System-Imports from the system file systemExamples Debug ssl-proxy This example shows how to turn on App debugging This example shows how to turn on FDU debuggingThis example shows how to turn on IPC debugging This example shows how to turn on PKI debuggingThis example shows how to turn on TCP debugging This example shows how to turn off TCP debuggingSsl-proxy#debug ssl-proxy tcp Ssl-proxy#no debug ssl-proxy tcpConfiguration mode Do commandCommand EXEC-level command to be executed Ssl-proxy#show ssl-proxy admin-info Show ssl-proxy admin-infoShow ssl-proxy admin-info This command has no default settings Show ssl-proxy buffersShow ssl-proxy buffers Ssl-proxy#show ssl-proxy buffersShow ssl-proxy certificate-history service name Service nameOptionally for a specific proxy service Show ssl-proxy certificate-historySsl-proxy# show ssl-proxy certificate-history Record 1, Timestamp000051, 163634 UTC Oct 31Related Commands ssl-proxy service Show ssl-proxy conn service name Show ssl-proxy conn4tuple RemoteSsl-proxy#show ssl-proxy conn 200.200.1438814 58796 Show ssl-proxy crash-info Show ssl-proxy crash-info brief detailsBrief Limited to processor registersStack top Printing 1024 bytes from stack top Ssl-proxy#show ssl-proxy crash-info briefShow ssl-proxy mac address Show ssl-proxy mac addressModule with SSL Ssl-proxy#show ssl-proxy mac addressShow ssl-proxy natpool Show ssl-proxy natpool nameName Optional NAT pool name Ssl-proxy#show ssl-proxy natpool NP1Show ssl-proxy policy Show ssl-proxy policy http-header ssl tcp url-rewrite nameHttp-header Url-rewriteMSS Show ssl-proxy service Show ssl-proxy service nameName Optional Service name Ssl-proxy#show ssl-proxy serviceProxy status No Client VLAN, No Server Vlan Ssl-proxy# Stats Show ssl-proxy statsShow ssl-proxy stats type This example shows how to display the PKI statistics Ssl-proxy#show ssl-proxy stats pki PKI Memory Usage CountersThis example shows how to display the FDU statistics Ssl-proxy# show ssl-prox stats fduShow ssl-proxy status Show ssl-proxy statusShow ssl-proxy status SSL cpu is alive Ssl-proxy#show ssl-proxy version Show ssl-proxy versionShow ssl-proxy version Show ssl-proxy vlan Show ssl-proxy vlan vlan-iddebugDebug Optional Displays debug informationSsl-proxy#show ssl-proxy vlan This command has no default settings Exec modeShow ssl-proxy vts Snmp-server enable Defaults Command Modes Command History ExamplesSeconds Global configuration This example shows how to start a cryptographic self-testSsl-proxy crypto selftest Time-intervalSsl-proxy mac address mac-addr Related Commands show ssl-proxy mac addressSsl-proxy mac address Ssl-proxy natpool This example shows how to define a pool of IP addressesRelated Commands show ssl-proxy natpool Ssl-proxy pki Related Commands show ssl-proxy stats This example shows how to specify the cache sizeThis example shows how to enable PKI event-history Http-header-policy-name Http header policy name Ssl-proxy policy http-headerSsl-proxy policy http-header http-header-policy-name Custom custom-string Timeout session timeout absolute Ssl-proxy policy sslSsl-proxy policy ssl ssl-policy-name Ssl-policy-name SSL policy nameRSAWITHRC4128SHA all No close-protocol enable Default cipher close-protocolNo session-cache enable Timeout handshake timeoutThis example shows how to enable session-cache This example shows how to disable session-cacheSsl-proxy config# ssl-proxy policy ssl sslpl1 Ssl-proxyconfig-ssl-policy#cipher RSAWITH3DESEDECBCSHAThis example shows how to print out a help Defaults are as follows Timeout reassembly is 60 secondsSsl-proxy policy tcp Ssl-proxy policy tcp tcp-policy-nameNo timeout syn timeout-in-seconds No timeout reassembly timeNo buffer-share rx buffer-limit-in-bytes No buffer-share tx buffer-limit-in-bytesRelated Commands show ssl-proxy policy Ssl-proxy policy url-rewrite Ssl-proxy policy url-rewrite url-rewrite-policy-nameSsl-proxy config# ssl-proxy policy url-rewrite test1 Ssl-proxyconfig-url-rewrite-policy#This command has no arguments or keywords Ssl-proxy pool caSsl-proxy pool ca-pool-name Ca-pool-name Certificate authority pool nameSsl-proxy service Ssl-proxy service ssl-proxy-nameclientSsl-proxy service client command Protocol protocol port portno subcommandAuthenticate verify all signature-only Default certificate inservice nat serverInservice Certificate rsa general-purpose trustpointSsl-proxy config-ssl-proxy# Related Commands show ssl-proxy service Declares a proxy client as administratively up Ssl-proxy service clientExits from proxy-client configuration submode Applies a URL rewrite policy to the proxy server Sslv2 keyword enables SSL versionSsl-proxy config# ssl-proxy service S7 client Ssl-proxy config-ssl-proxy# server policy tcp tcppl1 Ssl-proxy config# ssl-proxy ssl ratelimit Ssl-proxy config# no ssl-proxy ssl ratelimitSsl-proxy ssl ratelimit Ssl-proxyy ssl ratelimitAdmin Ssl-proxy vlanSsl-proxy vlan vlan Gateway prefix drop forward1Standby authentication Standby delay minimum reloadStandby ip Standby mac-addressSsl-proxyconfig-vlan#ipaddr 10.1.0.20 Ssl-proxyconfig-vlan#ipaddr 208.59.100.18Ssl-proxyconfig-vlan#route 210.0.207.0 255.0.0.0 gateway Related Commands show ssl-proxy vlan Standby authentication Group-number is String is ciscoStandby delay minimum reload Min-delay is 1 second Reload-delay is 5 secondsShow standby delay Ssl-proxyconfig-vlan#standby delay minimum 30 reloadHsrp is disabled by default Proxy-VLAN configuration submodeStandby ip SecondaryUsed by the hot standby group is learned using Hsrp Standby mac-address Standby group-numbermac-addressmac-addressNo standby group-numbermac-address Mac-address MAC addressShow standby Ssl-proxyconfig-vlan#standby 1 mac-addressThat is used in the end nodes Standby mac-refresh Standby mac-refresh seconds no standby mac-refreshHsrp is disabled Standby nameStandby name group-name No standby name group-name Group-name Specifies the name of the standby groupDelay Minimum delayReload delay Sync delayOperation returns to the default behavior Leaves any synchronization delay if it was configuredSsl-proxyconfig-vlan#standby preempt delay minimum ClientsThis example shows how to change the router priority Standby priorityStandby group-numberpriority priority No standby group-numberpriority priorityStandby track Enable DisableTimers Standby redirectsShow standby redirect Related Commands show standbySsl-proxyconfig-vlan#standby redirects timers 90 Standby timers MsecInterface ethernet Command commands and take action when the object changes Standby trackDecrement priority Back upRouter a Configuration Router B ConfigurationRelated Commands standby preempt Standby priorityScope interface Standby use-biaStandby use-bia scope interface No standby use-bia OL-7029-01 Acronym Expansion Cbac CCACDP CEFDram DsapDscp DspuICD IcmpIDB IDPMD5 MdixMdss MFDOSI OSMOspf PAERmon ROMRommon RPCSTP SVCSVI TACACS+Weighted round-robin WRRXNS Xerox Network SystemOL-7029-01 Capp UDP HttpCapp IN-1IN-2 NATXML IN-3 See FTP FTPGslb IN-4Secondary interface IN-5IN-6 ConfigurationPool addresses Gslb Http IN-7Real server Backup Enabling IN-8Smtp IN-9IN-10 TCPURL IN-11 Credentials Enabling Port Statistics display Vlan IN-12